Executive brief
Bouncy Castle is a widely used cryptographic library for Java applications. A flaw in its implementation of the GOST encryption standard causes the security counter to reset prematurely after a small amount of data is processed. This allows an attacker to potentially decrypt sensitive information or recover original data by comparing different encrypted messages that used the same recycled security key.
Technical details
The GOST 28147-2015 CTR mode implementation (G3413CTRBlockCipher) in the Bouncy Castle Java 'bcprov' module contains a logic error where only the final byte of the counter is incremented. This causes the counter to wrap around after only 255 blocks, leading to keystream reuse. In CTR mode, keystream reuse (nonce/counter reuse) is a critical cryptographic failure that allows an attacker who can observe multiple ciphertexts encrypted with the same key and IV to recover the XOR sum of the plaintexts, effectively breaking confidentiality. The vulnerability is tracked as CWE-323 and is fixed in version 1.84, with backported fixes in 1.80.2 and 1.81.1.
Affected products
- Legion of the Bouncy Castle Bouncy Castle Java (BC-JAVA) >= 1.59, < 1.84 (excluding 1.80.2 and 1.81.1)
Timeline
- 2026-04-15: disclosed: NVD publication date
- 2026-04-17: advisory: GitHub Advisory published
- 2026-06-30: other: Advisory last updated
References
- https://api.github.com/users/simon-reisinger-dynatrace
- https://github.com/simon-reisinger-dynatrace
- https://api.github.com/users/simon-reisinger-dynatrace/gists%7B/gist_id%7D
- https://api.github.com/users/simon-reisinger-dynatrace/repos
- https://avatars.githubusercontent.com/u/176280510?v=4
- https://api.github.com/users/simon-reisinger-dynatrace/events%7B/privacy%7D