Description
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher.

GOSTCTR implementation unable to process more than 255 blocks correctly.


This issue affects BC-JAVA: from 1.59 before 1.84.
Published: 2026-04-15
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Cryptographic compromise
Action: Immediate Patch
AI Analysis

Impact

A broken or risky cryptographic algorithm is used in the Legion of the Bouncy Castle Inc. BC-Java bcprov library. The GOSTCTR implementation fails to process more than 255 blocks correctly, which can undermine the security of data encrypted with this algorithm. The weakness is identified as a cryptographic algorithm weakness, allowing an adversary to potentially compromise confidentiality of data.

Affected Systems

Products affected are BC-Java bcprov from version 1.59 up to but excluding 1.84. Organizations using these library versions must review deployment of the GOSTCTR cipher.

Risk and Exploitability

The CVSS score is 9.3, indicating a critical severity. There is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog. The exact attack vector is not described in the CVE data, but given the nature of the flaw it is inferred that an attacker could exploit the weak encryption to decrypt or forge data if the library is used for cryptographic operations.

Generated by OpenCVE AI on April 15, 2026 at 11:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the BC-Java library to version 1.84 or later, which resolves the GOSTCTR block processing bug.
  • Remove or replace any use of the GOSTCTR cipher beyond 255 blocks until a secure implementation is available.
  • Conduct a code audit to identify all instances of the BC-Java library and verify that the upgraded version is deployed in production.

Generated by OpenCVE AI on April 15, 2026 at 11:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Bouncycastle
Bouncycastle bc-java
Vendors & Products Bouncycastle
Bouncycastle bc-java

Wed, 15 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 15 Apr 2026 10:45:00 +0000

Type Values Removed Values Added
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

 cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red'}

Wed, 15 Apr 2026 09:30:00 +0000

Type Values Removed Values Added
Description Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. GOSTCTR implementation unable to process more than 255 blocks correctly. This issue affects BC-JAVA: from 1.59 before 1.84.
Title GOSTCTR implementation unable to process more than 255 blocks correctly
Weaknesses CWE-327
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Bouncycastle Bc-java
cve-icon MITRE

Status: PUBLISHED

Assigner: bcorg

Published:

Updated: 2026-04-15T13:19:49.520Z

Reserved: 2025-12-17T00:17:44.229Z

Link: CVE-2025-14813

cve-icon Vulnrichment

Updated: 2026-04-15T13:19:45.930Z

cve-icon NVD

Status : Received

Published: 2026-04-15T10:16:38.243

Modified: 2026-04-15T11:16:32.363

Link: CVE-2025-14813

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T14:53:12Z

Weaknesses