CVE-2025-14813
- Source
- https://cve.org/CVERecord?id=CVE-2025-14813
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-14813.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-14813
- Aliases
- Downstream
- Related
- Published
- 2026-04-15T08:56:34.057Z
- Modified
- 2026-08-14T09:11:16.818117Z
- Severity
-
- 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red CVSS Calculator
- Summary
- GOSTCTR implementation unable to process more than 255 blocks correctly
- Details
-
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).
This vulnerability is associated with program files G3413CTRBlockCipher.
This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
- Database specific
{ "cna_assigner": "bcorg", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14813.json", "cwe_ids": [ "CWE-327" ] }- References
-
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json
- https://www.bouncycastle.org/download/bouncy-castle-java/
- https://access.redhat.com/errata/RHSA-2026:11720
- https://access.redhat.com/errata/RHSA-2026:11721
- https://access.redhat.com/errata/RHSA-2026:13631
- https://access.redhat.com/errata/RHSA-2026:14272
- https://access.redhat.com/errata/RHSA-2026:14276
- https://access.redhat.com/errata/RHSA-2026:17668
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/security/cve/CVE-2025-14813
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14813.json
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813
- https://nvd.nist.gov/vuln/detail/CVE-2025-14813
- https://bugzilla.redhat.com/show_bug.cgi?id=2458640
- https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3
- https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f
- https://github.com/bcgit/bc-java
Affected packages
Git / github.com/bcgit/bc-java
Affected ranges
- Type
- GIT
- Repo
- https://github.com/bcgit/bc-java
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "1.59" }, { "fixed": "1.80.2" }, { "introduced": "1.81" }, { "fixed": "1.81.1" }, { "introduced": "1.82" }, { "fixed": "1.84" } ], "source": [ "DESCRIPTION", "REFERENCES" ] }
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-14813.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"262386939091886332078283368458154035620",
"241903356408364102397713104555431676338",
"237104995760111515567516545948185958019",
"260088556733241009645093216339235896362",
"5279621054392667723777881444889999928",
"324944887105293821129491217626875010557",
"270453564589089163720850664440047201843",
"329322209623640002993202889481694352444",
"66155707311067247870190037078741720121",
"161374838074741889965706815960646264073"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-14813-5c2066ec",
"target": {
"file": "core/src/test/java/org/bouncycastle/crypto/test/GOST3412Test.java"
},
"source": "https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f"
},
{
"deprecated": false,
"digest": {
"function_hash": "135703389312834859365583448199898207812",
"length": 52.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-14813-b573c35e",
"target": {
"file": "core/src/main/java/org/bouncycastle/crypto/modes/G3413CTRBlockCipher.java",
"function": "generateCRT"
},
"source": "https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f"
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"175928512622813816927411613058255620780",
"211876437757400253120676713490220480890",
"14531829108997568855785504746495575882",
"10721386407721912421970380264210836072",
"123074660375816319627985141407678440428",
"207739806869907904924329820704048920558",
"26433357192408279692897001805920152210",
"297915715314933593763912232628169184385",
"172392507172562242006100768533521083017"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-14813-c79f6a31",
"target": {
"file": "pkix/src/test/java/org/bouncycastle/cert/cmp/test/AllTests.java"
},
"source": "https://github.com/bcgit/bc-java/commit/dd0e7f83eef6b5d157139c9da21852d44bfcef71"
},
{
"deprecated": false,
"digest": {
"function_hash": "32988096120628785176370459321828206469",
"length": 1240.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-14813-d796c600",
"target": {
"file": "pkix/src/test/java/org/bouncycastle/cert/cmp/test/AllTests.java",
"function": "testComposite"
},
"source": "https://github.com/bcgit/bc-java/commit/dd0e7f83eef6b5d157139c9da21852d44bfcef71"
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"300276481577487608390511461847156506634",
"72522421026871186003987298727235672255",
"248267566282422170437507320289939179897",
"138697558518558829764409570695921082925",
"77795620714087101855215776586887480360",
"253117628173900454412939023697079452098",
"208234895684152768712941298085623426170",
"135859151753741312629440454464083697812",
"34657907477393269367890762234709985303",
"162613496227733929556244931463578218449",
"23508661060569098979606906785804307616",
"205494679626699834684157133405272565850",
"270832754347741209623177904078690096985",
"44411157617046897982588222964373660319",
"243716333709493041231698108128808029013",
"287610177451687686823260933424799021201",
"42582010187046702125651359236594596468",
"76149004579646775163727134742480470349",
"211854039433732041274137846380870222224",
"87129416677021730283748693137420676406",
"180478707998351201328850126237475280813",
"335503892522674268647705888493576315498"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-14813-db0baff6",
"target": {
"file": "core/src/main/java/org/bouncycastle/crypto/modes/G3413CTRBlockCipher.java"
},
"source": "https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f"
},
{
"deprecated": false,
"digest": {
"function_hash": "75074325176343452193019954033376254166",
"length": 62.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-14813-e313969d",
"target": {
"file": "core/src/test/java/org/bouncycastle/crypto/test/GOST3412Test.java",
"function": "performTest"
},
"source": "https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f"
}
]
vanir_signatures_modified
"2026-08-14T09:11:16Z"