The vulnerability exists in the native one‑shot CTR packet cipher of Bouncy Castle for Java LTS versions before 2.73.13. The implementation fails to verify that the requested input length fits within the counter space left by the initialization vector (IV). When the IV segment allows only a few bytes of counter space, a longer input causes the counter to wrap. The library then repeats the keystream, returning the full input length as if each byte had been properly encrypted. This flaw allows an attacker to reconstruct plaintexts from ciphertext alone without knowledge of the secret key, representing a high‑impact cryptographic key‑reuse exploit (CWE‑323).

Legion of the Bouncy Castle Inc. – BC‑LTS‑JAVA. Versions prior to 2.73.13 are impacted. The pure Java provider (bcprov) is not affected because it does not ship native code.

The CVSS score of 8.2 indicates high severity, and the vulnerability is not yet listed in CISA’s KEV catalog. With no EPSS information available, the exploitation probability is unknown, though the vector likely involves supplying a crafted, long ciphertext to a vulnerable application that uses the native CTR mode. Because the flaw releases the same keystream twice, an attacker with access to both ciphertext segments can recover the underlying plaintexts. The issue has no runtime exception or length truncation, so detection is difficult; however, patched versions perform a pre‑flight counter‑range check that rejects over‑long requests, making the operation failure‑atomic.