high
7.5
CVE-2025-14813 json
GOSTCTR implementation unable to process more than 255 blocks correctly
published 2026-04-15 6 mo ago modified 2026-10-07 33 d ago also GHSA-574f-3g2m-x479 , EUVD-2025-209467
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).
This vulnerability is associated with program files G3413CTRBlockCipher.
This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Patch / fix
- maven org.bouncycastle:bcprov-jdk14 1.84
- maven org.bouncycastle:bcprov-jdk15to18 1.84
- maven org.bouncycastle:bcprov-jdk18on 1.80.2, 1.81.1, 1.84
- maven org.bouncycastle:bcprov-debug-jdk14 1.84
- maven org.bouncycastle:bcprov-debug-jdk15to18 1.84
- maven org.bouncycastle:bcprov-debug-jdk18on 1.84
- Legion of the Bouncy Castle Inc. BC-JAVA 1.80.2, 1.81.1, 1.84
- Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 debug-jdk15on
- Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:1.5.26-2.Final_redhat_00001.1.el7eap, 0:1.10.0-46.Final_redhat_00044.1.el7eap, 0:2.2.40-2.SP3_redhat_00001.1.el7eap, 0:2.3.14-11.SP11_redhat_00001.1.el7eap, 0:2.5.5-24.SP12_redhat_00016.1.el7eap, 0:2.5.5-30.SP12_redhat_00020.1.el7eap, 0:2.16.0-22.redhat_00057.1.el7eap, 0:2.18.8-1.redhat_00003.1.el7eap, 0:4.1.135-1.Final_redhat_00001.1.el7eap, 0:5.0.31-3.SP2_redhat_00001.1.el7eap, 0:7.4.25-2.GA_redhat_00001.1.el7eap
- Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 0:1.5.26-2.Final_redhat_00001.1.el8eap, 0:1.10.0-46.Final_redhat_00044.1.el8eap, 0:2.2.40-1.SP3_redhat_00001.1.el8eap, 0:2.3.14-11.SP11_redhat_00001.1.el8eap, 0:2.5.5-24.SP12_redhat_00016.1.el8eap, 0:2.5.5-30.SP12_redhat_00020.1.el8eap, 0:2.16.0-22.redhat_00057.1.el8eap, 0:2.18.8-1.redhat_00003.1.el8eap, 0:4.1.135-1.Final_redhat_00001.1.el8eap, 0:5.0.31-3.SP2_redhat_00001.1.el8eap, 0:7.4.25-2.GA_redhat_00001.1.el8eap
- Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 0:1.5.26-2.Final_redhat_00001.1.el9eap, 0:1.10.0-46.Final_redhat_00044.1.el9eap, 0:2.2.40-1.SP3_redhat_00001.1.el9eap, 0:2.3.14-11.SP11_redhat_00001.1.el9eap, 0:2.5.5-24.SP12_redhat_00016.1.el9eap, 0:2.5.5-30.SP12_redhat_00020.1.el9eap, 0:2.16.0-22.redhat_00057.1.el9eap, 0:2.18.8-1.redhat_00003.1.el9eap, 0:4.1.135-1.Final_redhat_00001.1.el9eap, 0:5.0.31-3.SP2_redhat_00001.1.el9eap, 0:7.4.25-2.GA_redhat_00001.1.el9eap
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA 1.84.0.redhat-00001
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:1.84.0-1.redhat_00001.1.el8eap
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:1.84.0-1.redhat_00001.1.el9eap
- Red Hat OpenShift Developer Tools and Services 4.12 1786628667
- Red Hat OpenShift Developer Tools and Services 4.13 1786628681
- Red Hat OpenShift Developer Tools and Services 4.14 1786533561
- Red Hat OpenShift Developer Tools and Services 4.15 1786533565
- Red Hat OpenShift Developer Tools and Services 4.16 1787125166
- Red Hat OpenShift Developer Tools and Services 4.17 1787124635
- Red Hat OpenShift Developer Tools and Services 4.18 1787125069
- Red Hat OpenShift Developer Tools and Services 4.19 1787124632
- Red Hat OpenShift Developer Tools and Services 4.20 1787124925
- Red Hat OpenShift Developer Tools and Services 4.21 1787125311
- Red Hat OpenShift Developer Tools and Services 4.22 1787124779
- Red Hat Red Hat OpenShift AI 2.25 1780069506
- Red Hat Red Hat OpenShift Dev Spaces 3.28 1779359423, 1779528224
- rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el8sso
- rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el8sso
- rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el9sso
- rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el9sso
- rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el7sso
- rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el7sso
- eap8-angus jboss enterprise application platform 8.1 2.0.5-1.redhat_00001.1.el8eap
- eap8-guava jboss enterprise application platform 8.1 33.0.0-3.jre_redhat_00004.1.el8eap
red hat advisories RHSA-2026:76129RHSA-2026:76130RHSA-2026:76128RHSA-2026:53645RHSA-2026:53646RHSA-2026:53644
- bouncycastle openSUSE Tumbleweed 1.84-1.1
opensuse advisories openSUSE-SU-2026:10571-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-14813 updated cvss 7.5
bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly
-
Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins Red Hat AMQ Clients bcprov-jdk18on Red Hat build of Apache Camel 4 for Quarkus 3 bcprov-jdk18onaffected: workaround, no fix available
-
Red Hat build of Debezium 3 bcprov-lts8on, bcprov-jdk18on, bcprov-ext-jdk15on Red Hat Build of Keycloak bcprov-jdk18on Red Hat Enterprise Linux 8 resteasy, resteasy-javadocaffected: workaround, no fix planned “Will not fix”
-
Red Hat Enterprise Linux 9 jmcaffected: workaround, no fix available
-
Red Hat Fuse 7 bcprov-jdk15, bcprov-jdk16, bcprov-jdk15on, bcprov-jdk18on, bcprov-jdk15to18, bcprov-ext-jdk15on, +2 moreaffected: workaround, no fix planned “Will not fix”
-
Red Hat JBoss Enterprise Application Platform 7 bcprov-jdk15on Red Hat JBoss Enterprise Application Platform 8 bcprov-jdk12, bcprov-jdk15, bcprov-jdk15on, bcprov-jdk18on, bcprov-jdk15to18, bcprov-ext-jdk18on Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel8affected: workaround, no fix available
-
Red Hat Process Automation 7 bcprov-jdk15on, bcprov-jdk15to18affected: workaround, no fix planned “Will not fix”
-
Red Hat streams for Apache Kafka 2 bcprov-jdk18onaffected: workaround, no fix available
-
Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-85fixed: vendor fix RHSA-2026:76134
show 26 moreshow fewer
-
Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1786628667fixed: vendor fix RHSA-2026:60247
-
Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1786628681fixed: vendor fix RHSA-2026:60249
-
Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1786533561fixed: vendor fix RHSA-2026:60248
-
Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1786533565fixed: vendor fix RHSA-2026:60239
-
Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1787125166fixed: vendor fix RHSA-2026:60251
-
Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1787124635fixed: vendor fix RHSA-2026:60246
-
Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1787125069fixed: vendor fix RHSA-2026:60250
-
Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1787124632fixed: vendor fix RHSA-2026:60252
-
Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1787124925fixed: vendor fix RHSA-2026:60259
-
Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1787125311fixed: vendor fix RHSA-2026:60254
-
Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1787124779fixed: vendor fix RHSA-2026:60256
-
Red Hat AMQ Broker 7.12.7fixed: vendor fix RHSA-2026:14276
-
Red Hat AMQ Broker 7.13.5fixed: vendor fix RHSA-2026:14272
-
Red Hat AMQ Broker 7.14.1fixed: vendor fix RHSA-2026:66488
-
Red Hat Build of Apache Camel 4.14 for Quarkus 3.27fixed: vendor fix RHSA-2026:13631
-
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14fixed: vendor fix RHSA-2026:17668
-
Red Hat build of Quarkus 3.20.6.SP1 bcprov-jdk18on 1.84.0.redhat-00001fixed: vendor fix RHSA-2026:11720
-
Red Hat build of Quarkus 3.27.3.SP1 bcprov-jdk18on 1.84.0.redhat-00001fixed: vendor fix RHSA-2026:11721
-
Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.25-2.GA_redhat_00001.1.el7eap, eap7-jackson-core 2.18.8-1.redhat_00003.1.el7eap, eap7-netty 4.1.135-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-jackson-databind 2.18.8-1.redhat_00003.1.el7eap, eap7-netty-all 4.1.135-1.Final_redhat_00001.1.el7eap, +78 morefixed: vendor fix RHSA-2026:53644
-
Red Hat JBoss EAP 8.1 for RHEL 8 eap8-bouncycastle 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-pg 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-pkix 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-prov 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-util 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-jmail 1.84.0-1.redhat_00001.1.el8eapfixed: vendor fix RHSA-2026:18054
-
Red Hat JBoss EAP 8.1 for RHEL 9 eap8-bouncycastle 1.84.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-pg 1.84.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-pkix 1.84.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-prov 1.84.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-util 1.84.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-jmail 1.84.0-1.redhat_00001.1.el9eapfixed: vendor fix RHSA-2026:18055
-
Red Hat JBoss Enterprise Application Platform 7.4.25fixed: vendor fix RHSA-2026:53806
-
Red Hat JBoss Enterprise Application Platform 8.1.6.GA bcprov-jdk18on 1.84.0.redhat-00001fixed: vendor fix RHSA-2026:18059
-
Red Hat OpenShift AI 2.25 rhoai/odh-modelmesh-rhel9 1780069506fixed: vendor fix RHSA-2026:24977
-
Red Hat OpenShift Dev Spaces 3.28 devspaces/openvsx-rhel9 1779528224, devspaces/pluginregistry-rhel9 1779359423fixed: vendor fix RHSA-2026:21772
-
Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.20-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.20-1.redhat_00001.1.el7ssofixed: vendor fix RHSA-2026:76128
3 more fixed, 29 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red |
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.bouncycastle:bcprov-jdk14 | >=1.59, <=1.80.1 1 listed version >=1.82, <1.84 |
1.84 |
| maven | org.bouncycastle:bcprov-jdk15to18 | >=1.59, <=1.80.1 1 listed version >=1.82, <1.84 |
1.84 |
| maven | org.bouncycastle:bcprov-jdk18on | >=1.59, <1.80.2 >=1.81.0, <1.81.1 >=1.82, <1.84 |
1.80.2 1.81.1 1.84 |
| maven | org.bouncycastle:bcprov-debug-jdk14 | >=1.59, <=1.80.1 1 listed version >=1.82, <1.84 |
1.84 |
| maven | org.bouncycastle:bcprov-debug-jdk15to18 | >=1.59, <=1.80.1 1 listed version >=1.82, <1.84 |
1.84 |
| maven | org.bouncycastle:bcprov-debug-jdk18on | >=1.59, <=1.80.1 1 listed version >=1.82, <1.84 |
1.84 |
| maven | org.bouncycastle:bcprov-ext-jdk14 | >=1.59, <=1.78.1 |
no fix listed |
| maven | org.bouncycastle:bcprov-ext-jdk15to18 | >=1.59, <=1.78.1 |
no fix listed |
| maven | org.bouncycastle:bcprov-ext-jdk18on | >=1.59, <=1.78.1 |
no fix listed |
| maven | org.bouncycastle:bcprov-ext-debug-jdk14 | >=1.59, <=1.74 |
no fix listed |
| maven | org.bouncycastle:bcprov-ext-debug-jdk15to18 | >=1.59, <=1.77 |
no fix listed |
| maven | org.bouncycastle:bcprov-ext-debug-jdk18on | >=1.59, <=1.77 |
no fix listed |
| maven | org.bouncycastle:bcprov-debug-jdk15on | <=1.7.0 |
no fix listed |
| maven | org.bouncycastle:bcprov-jdk15on | <=1.7.0 |
no fix listed |
Affected products
- Legion of the Bouncy Castle Inc. BC-JAVA
- Red Hat Red Hat AMQ Broker 7.12.7
- Red Hat Red Hat AMQ Broker 7.13.5
- Red Hat Red Hat AMQ Broker 7.14.1
- Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
- Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
- Red Hat Red Hat build of Quarkus 3.20.6.SP1
- Red Hat Red Hat build of Quarkus 3.27.3.SP1
- Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
- Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- Red Hat OpenShift Developer Tools and Services 4.12
- Red Hat OpenShift Developer Tools and Services 4.13
- Red Hat OpenShift Developer Tools and Services 4.14
- Red Hat OpenShift Developer Tools and Services 4.15
- Red Hat OpenShift Developer Tools and Services 4.16
- Red Hat OpenShift Developer Tools and Services 4.17
- Red Hat OpenShift Developer Tools and Services 4.18
- Red Hat OpenShift Developer Tools and Services 4.19
- Red Hat OpenShift Developer Tools and Services 4.20
- Red Hat OpenShift Developer Tools and Services 4.21
- Red Hat OpenShift Developer Tools and Services 4.22
- Red Hat Red Hat OpenShift AI 2.25
- Red Hat Red Hat OpenShift Dev Spaces 3.28
- Red Hat Cryostat 4
- Red Hat OpenShift Developer Tools and Services
- Red Hat Red Hat AMQ Broker 7
- Red Hat Red Hat AMQ Clients
- Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat Red Hat build of Apicurio Registry 3
- Red Hat Red Hat build of Debezium 3
- Red Hat Red Hat Build of Keycloak
- Red Hat Red Hat Data Grid 8
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Fuse 7
- Red Hat Red Hat JBoss Enterprise Application Platform 8
- Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Red Hat OpenShift AI (RHOAI)
- Red Hat Red Hat Process Automation 7
- Red Hat Red Hat Satellite 6
- Red Hat Red Hat Single Sign-On 7
- Red Hat streams for Apache Kafka 2
- Red Hat streams for Apache Kafka 3
Classification
- Weakness
- Technology feeds
References
-
github.com
/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f
patch, web
-
github.com
/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3
patch, web
-
github.com
/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:53644
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:53645
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:18054
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:53646
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:18055
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60247
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60249
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60248
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60239
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60251
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60246
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60250
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60252
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60259
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60254
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60256
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:14276
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:14272
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:66488
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:13631
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:18059
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:24977
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:21772
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:17668
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:11720
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:11721
vendor-advisory, web
-
access.redhat.com
/security/cve/CVE-2025-14813
vdb-entry, web
-
bugzilla.redhat.com
/show_bug.cgi?id=2458640
issue-tracking, web
-
security.access.redhat.com
/data/csaf/v2/vex/2025/cve-2025-14813.json
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-14813
advisory
-
github.com
/bcgit/bc-java
package
-
access.redhat.com
/errata/RHSA-2026:53806
web
Sources
- CVE List CVE-2025-14813
- GitHub Advisory GHSA-574f-3g2m-x479
- NVD CVE-2025-14813
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.