ALAS2023-2026-1688 — Important: bouncycastle security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14813: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. GOSTCTR implementation unable to process more than 255 blocks correctly. This issue affects BC-JAVA: from 1.59 before 1.84.

Fixed packages 7

Release	Package	Fixed in
Amazon Linux · 2023	bouncycastle	0:1.70-4.amzn2023.0.6
Amazon Linux · 2023	bouncycastle-javadoc	0:1.70-4.amzn2023.0.6
Amazon Linux · 2023	bouncycastle-mail	0:1.70-4.amzn2023.0.6
Amazon Linux · 2023	bouncycastle-pg	0:1.70-4.amzn2023.0.6
Amazon Linux · 2023	bouncycastle-pkix	0:1.70-4.amzn2023.0.6
Amazon Linux · 2023	bouncycastle-tls	0:1.70-4.amzn2023.0.6
Amazon Linux · 2023	bouncycastle-util	0:1.70-4.amzn2023.0.6

Vulnerabilities 1

Critical 9.3

CVE-2025-14813

GOSTCTR implementation unable to process more than 255 blocks correctly

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.…

Legion of the Bouncy Castle BC-JAVA logstash-9.3 logstash-9.3-iamguarded-compat Ubuntu Wolfi Maven

Apr 15, 2026

References

web
https://alas.aws.amazon.com/cve/html/CVE-2025-14813.html