CVE-2025-14813: Bouncy Castle BC-JAVA risky cryptography in G3413CTRBlockCipher

CVE-2025-14813 · Severity: critical · CVSS 3.1 · Published 2026-04-15

Bouncy Castle is a widely used cryptographic library for Java applications. A flaw in its implementation of the GOST encryption standard causes the security counter to reset prematurely after a small amount of data is processed. This allows an attacker to potentially decrypt sensitive information or recover original data by comparing different encrypted messages that used the same recycled security key.

Technologies: Legion of the Bouncy Castle Inc. Java Cryptography APIs, org.bouncycastle:bcprov-jdk14 (Maven), org.bouncycastle:bcprov-jdk15on (Maven), org.bouncycastle:bcprov-jdk15to18 (Maven), org.bouncycastle:bcprov-jdk18on (Maven). Vendors: Legion of the Bouncy Castle Inc., Maven.

Quick answers

Is CVE-2025-14813 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-14813 being exploited in the wild.
How severe is CVE-2025-14813?
Critical severity, with a CVSS score of 3.1, published 15 April 2026.
Which products and versions are affected?
org.bouncycastle:bcprov-debug-jdk14 (Maven) ECOSYSTEM:introduced=1.59,last_affected=1.80.1; org.bouncycastle:bcprov-debug-jdk15on (Maven) ECOSYSTEM:introduced=0,last_affected=1.7.0; org.bouncycastle:bcprov-debug-jdk15to18 (Maven) ECOSYSTEM:introduced=1.59,last_affected=1.80.1; org.bouncycastle:bcprov-debug-jdk18on (Maven) ECOSYSTEM:introduced=1.59,last_affected=1.80.1; and 10 more.
Is there a fix for CVE-2025-14813?
Yes. org.bouncycastle:bcprov-jdk18on (Maven): upgrade to 1.80.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-14813 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2025-14813?
Check whether you run Legion of the Bouncy Castle Inc. Java Cryptography APIs, org.bouncycastle:bcprov-debug-jdk14 (Maven), org.bouncycastle:bcprov-debug-jdk15on (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.bouncycastle:bcprov-jdk18on (Maven): upgrade to 1.80.2 or later
    # set org.bouncycastle:bcprov-jdk18on to 1.80.2 in your pom.xml or build.gradle

Technical details

The GOST 28147-2015 CTR mode implementation (G3413CTRBlockCipher) in the Bouncy Castle Java 'bcprov' module contains a logic error where only the final byte of the counter is incremented. This causes the counter to wrap around after only 255 blocks, leading to keystream reuse. In CTR mode, keystream reuse (nonce/counter reuse) is a critical cryptographic failure that allows an attacker who can observe multiple ciphertexts encrypted with the same key and IV to recover the XOR sum of the plaintexts, effectively breaking confidentiality. The vulnerability is tracked as CWE-323 and is fixed in version 1.84, with backported fixes in 1.80.2 and 1.81.1.

Affected products

  • Legion of the Bouncy Castle Bouncy Castle Java (BC-JAVA) >= 1.59, < 1.84 (excluding 1.80.2 and 1.81.1)

Identifiers

  • CVE-2025-14813
  • GHSA-574f-3g2m-x479

Timeline

  • 2026-04-15: disclosed: NVD publication date
  • 2026-04-17: advisory: GitHub Advisory published
  • 2026-06-30: other: Advisory last updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.