CVE-2025-14813: Bouncy Castle GOST 28147 CTR Mode Keystream Reuse Vulnerability
Summary
CVE-2025-14813: Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks. Affects org.bouncycastle:bcprov-jdk14 across 2 version ranges.
>= 1.59, <= 1.80.1
>= 1.82, < 1.84
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bouncy Castle is a widely used cryptographic library for Java that provides a range of cryptographic algorithms and protocols. It is utilized in various applications to ensure secure data transmission and storage. The library's GOST 28147-2015 implementation, specifically the CTR mode, has a critical vulnerability that affects its ability to securely generate keystreams, leading to potential data breaches.
Vulnerability Detail
The vulnerability arises from the GOST 28147-2015 CTR mode implementation in the Bouncy Castle library, where the counter only increments the final byte. This design flaw causes the counter to wrap after 255 blocks, resulting in the reuse of the keystream. When an attacker observes two ciphertexts generated with the same key and initialization vector (IV), they can recover the XOR of the plaintexts, effectively compromising the confidentiality of the data. This vulnerability is classified as critical with a CVSS score of 9.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing additional security measures such as using unique keys and IVs for each encryption operation to mitigate the risk of keystream reuse. However, this is not a substitute for applying the patch.
Conclusion
The Bouncy Castle GOST 28147 CTR mode vulnerability (CVE-2025-14813) poses a significant risk to data confidentiality due to keystream reuse. It is crucial to update to the latest patched versions of the library to mitigate this risk and ensure the security of cryptographic operations.
See every vulnerability recorded for org.bouncycastle:bcprov-jdk14 →
FAQ
The vulnerability allows attackers to recover plaintext data by observing ciphertexts generated with the same key and IV, compromising data confidentiality.
Versions of Bouncy Castle from 1.59 to 1.80.1 are affected. Ensure to update to 1.80.2 or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application's pom.xml on the Vulert playground without requiring signup.
The CVSS score for this vulnerability is 9.3, indicating a critical level of severity.
Implement additional security measures such as using unique keys and IVs for each encryption operation to reduce the risk of keystream reuse.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.bouncycastle:bcprov-jdk14.
