Skip to content
OpenAdvisories
Critical · 9.3 CVE-2025-14813 EUVD-2025-209467GHSA-574f-3g2m-x479

GOSTCTR implementation unable to process more than 255 blocks correctly

Published Apr 15, 2026 · Updated Sep 18, 2026 · Assigned by bcorg

Vendor: Legion of the Bouncy Castle Product: BC-JAVA Package: bouncycastle Package: keycloak-26.4-iamguarded-compat Package: keycloak-26.5 Package: keycloak-26.5-iamguarded-compat Package: logstash-9.3 Package: logstash-9.3-iamguarded-compat Package: logstash-9.4 Package: logstash-9.4-iamguarded-compat Package: org.bouncycastle:bcprov-debug-jdk14 Package: org.bouncycastle:bcprov-debug-jdk15on Package: org.bouncycastle:bcprov-debug-jdk15to18 Package: org.bouncycastle:bcprov-debug-jdk18on Package: org.bouncycastle:bcprov-ext-debug-jdk14 Package: org.bouncycastle:bcprov-ext-debug-jdk15to18 Package: org.bouncycastle:bcprov-ext-debug-jdk18on Package: org.bouncycastle:bcprov-ext-jdk14 Package: org.bouncycastle:bcprov-ext-jdk15to18 Package: org.bouncycastle:bcprov-ext-jdk18on Package: org.bouncycastle:bcprov-jdk14 Package: org.bouncycastle:bcprov-jdk15on Package: org.bouncycastle:bcprov-jdk15to18 Package: org.bouncycastle:bcprov-jdk18on Package: sonarqube Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).

This vulnerability is associated with program files G3413CTRBlockCipher.

This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Affected products

VendorProductAffectedFixed
Legion of the Bouncy Castle BC-JAVA 1.59 – < 1.80.2, 1.81 – < 1.81.1, 1.82 – < 1.84 1.80.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 bouncycastle No fix yet —
Ubuntu 26.04 LTS bouncycastle No fix yet —
Ubuntu 25.10 bouncycastle No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS bouncycastle No fix yet —
Ubuntu Pro 22.04 LTS bouncycastle No fix yet —
Ubuntu Pro 20.04 LTS bouncycastle No fix yet —
Ubuntu Pro 18.04 LTS bouncycastle No fix yet —
Ubuntu Pro 16.04 LTS bouncycastle No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Single Sign On 7 rh-sso7-keycloak +1 18.0.20-1.redhat_00001.1.el7sso RHSA-2026:76130, RHSA-2026:76129, RHSA-2026:76128
Red Hat Jboss Enterprise Application Platform Els 7 eap7-activemq-artemis +15 2.16.0-22.redhat_00057.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-glassfish-jsf 2.3.14-11.SP11_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-ironjacamar +8 1.5.26-2.Final_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jackson-core +10 2.18.8-1.redhat_00003.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-remoting 5.0.31-3.SP2_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-server-migration +2 1.10.0-46.Final_redhat_00044.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-netty +26 4.1.135-1.Final_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-picketlink-api +7 2.5.5-24.SP12_redhat_00016.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-picketlink-bindings +1 2.5.5-30.SP12_redhat_00020.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-undertow 2.2.40-2.SP3_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly +4 7.4.25-2.GA_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.40.0-6.redhat_00012.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-angus +1 2.0.5-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-angus-activation 2.0.3-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.84.0-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 801.6.0-1.GA_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-guava +1 33.0.0-3.jre_redhat_00004.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-guava-failureaccess 1.0.3-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-hal-console 3.7.19-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-hibernate +2 6.6.48-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-hibernate-search +6 7.2.6-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jakarta-activation 2.1.4-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jboss-logging 3.6.2-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jboss-metadata +5 16.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jctools +1 4.0.6-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-netty +14 4.1.132-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-plexus-utils 3.6.1-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-reactivex-rxjava 3.1.12-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-reactivex-rxjava2 2.2.21-5.redhat_00003.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly +3 8.1.6-5.GA_redhat_00007.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-client-config 1.0.1-4.Final_redhat_00002.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-http-client +4 2.1.4-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-javadocs 8.1.1-10.GA_redhat_00017.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-openssl +1 2.3.0-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-openssl-el8-x86_64 2.3.0-1.Final.redhat.00001.1.el8eap RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-openssl-el9-x86_64 2.3.0-1.Final_redhat_00001.1.el9eap RHSA-2026:18055
Red Hat JBoss EAP 8 eap8-yasson 3.0.4-5.redhat_00007.1.el8eap RHSA-2026:18055, RHSA-2026:18054

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bouncycastle 1.84-1.1 openSUSE-SU-2026:10571-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 bouncycastle +6 1.70-4.amzn2023.0.6 ALAS2023-2026-1688

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling keycloak-26.5 +2 No fix yet —
Wolfi rolling logstash-9.3 +1 9.3.8-r0 —
Wolfi rolling logstash-9.4 +1 9.4.4-r0 —
Wolfi rolling sonarqube 26.6.0.123539-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.bouncycastle:bcprov-debug-jdk14 >= 1.59, <= 1.80.1 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-debug-jdk14 1.81.0 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-debug-jdk14 >= 1.82, < 1.84 1.84 GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-debug-jdk15on <= 1.7.0 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-debug-jdk15to18 >= 1.59, <= 1.80.1 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-debug-jdk15to18 1.81.0 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-debug-jdk15to18 >= 1.82, < 1.84 1.84 GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-debug-jdk18on >= 1.59, <= 1.80.1 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-debug-jdk18on 1.81.0 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-debug-jdk18on >= 1.82, < 1.84 1.84 GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-ext-debug-jdk14 >= 1.59, <= 1.74 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-ext-debug-jdk15to18 >= 1.59, <= 1.77 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-ext-debug-jdk18on >= 1.59, <= 1.77 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-ext-jdk14 >= 1.59, <= 1.78.1 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-ext-jdk15to18 >= 1.59, <= 1.78.1 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-ext-jdk18on >= 1.59, <= 1.78.1 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-jdk14 >= 1.59, <= 1.80.1 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-jdk14 1.81.0 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-jdk14 >= 1.82, < 1.84 1.84 GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-jdk15on <= 1.7.0 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-jdk15to18 >= 1.59, <= 1.80.1 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-jdk15to18 1.81.0 — GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-jdk15to18 >= 1.82, < 1.84 1.84 GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-jdk18on >= 1.59, < 1.80.2 1.80.2 GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-jdk18on >= 1.81.0, < 1.81.1 1.81.1 GHSA-574f-3g2m-x479
Maven org.bouncycastle:bcprov-jdk18on >= 1.82, < 1.84 1.84 GHSA-574f-3g2m-x479

Advisories 12

References