Description
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).

This vulnerability is associated with program files G3413CTRBlockCipher.



This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Published: 2026-04-15
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A broken or risky cryptographic algorithm is used in the Legion of the Bouncy Castle Inc. BC-Java bcprov library. The GOSTCTR implementation fails to process more than 255 blocks correctly, which can undermine the security of data encrypted with this algorithm. The weakness is identified as a cryptographic algorithm weakness, allowing an adversary to potentially compromise confidentiality of data.

Affected Systems

Products affected are BC-Java bcprov from version 1.59 up to but excluding 1.84. Organizations using these library versions must review deployment of the GOSTCTR cipher.

Risk and Exploitability

The CVSS score is 9.3, indicating a critical severity. This vulnerability has an EPSS score of < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The exact attack vector is not described in the CVE data, but given the nature of the flaw it is inferred that an attacker could exploit the weak encryption to decrypt or forge data if the library is used for cryptographic operations.

Generated by OpenCVE AI on May 19, 2026 at 00:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the BC-Java library to version 1.84 or later, which resolves the GOSTCTR block processing bug.
  • Remove or replace any use of the GOSTCTR cipher beyond 255 blocks until a secure implementation is available.
  • Conduct a code audit to identify all instances of the BC-Java library and verify that the upgraded version is deployed in production.

Generated by OpenCVE AI on May 19, 2026 at 00:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 18 May 2026 23:30:00 +0000

Type Values Removed Values Added
Description Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. GOSTCTR implementation unable to process more than 255 blocks correctly. This issue affects BC-JAVA: from 1.59 before 1.84. : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Wed, 29 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

threat_severity

Important

Wed, 15 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Bouncycastle
Bouncycastle bc-java
Vendors & Products Bouncycastle
Bouncycastle bc-java

Wed, 15 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 15 Apr 2026 10:45:00 +0000

Type Values Removed Values Added
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

 cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red'}

Wed, 15 Apr 2026 09:30:00 +0000

Type Values Removed Values Added
Description Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. GOSTCTR implementation unable to process more than 255 blocks correctly. This issue affects BC-JAVA: from 1.59 before 1.84.
Title GOSTCTR implementation unable to process more than 255 blocks correctly
Weaknesses CWE-327
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Bouncycastle Bc-java
cve-icon MITRE

Status: PUBLISHED

Assigner: bcorg

Published:

Updated: 2026-05-18T23:15:49.105Z

Reserved: 2025-12-17T00:17:44.229Z

Link: CVE-2025-14813

cve-icon Vulnrichment

Updated: 2026-04-15T13:19:45.930Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-15T10:16:38.243

Modified: 2026-05-19T00:16:36.770

Link: CVE-2025-14813

cve-icon Redhat

Severity : Important

Publid Date: 2026-04-15T08:56:34Z

Links: CVE-2025-14813 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-19T01:00:12Z

Weaknesses