Incorrect calculation in Bouncy Castle for Java - CVE-2025-14813

Vulnerability identifier: #VU132273

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-14813

CWE-ID: CWE-682

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause cryptographic operations to fail.

The vulnerability exists due to improper implementation in G3413CTRBlockCipher when encrypting or decrypting more than 255 blocks. A remote attacker can supply data that exceeds this limit to cause cryptographic operations to fail.

The issue affects the GOST-R-3413-2015 CTR mode implementation because it uses a single-byte counter instead of a counter size aligned with the algorithm definition.

Bouncy Castle for Java
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Development Tools Module
Fusion Content-Aware Storage
IBM Tivoli Netcool Configuration Manager
IBM Business Automation Manager Open Editions
ApplinX
Data Cataloging
IBM Fusion HCI
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Sterling Secure Proxy
IBM Sterling External Authentication Server
IBM Sterling Connect:Direct Web Services
IBM Sterling Control Center
Jira Service Management Data Center
Jira Software Data Center
IBM Cloud Object Storage Systems
Red Hat build of Quarkus
IBM Qradar SIEM
IBM DB2
bouncycastle
bouncycastle-pkix
bouncycastle-util
bouncycastle-pg
IBM Disconnected Log Collector
Red Hat Camel for Spring Boot

Install security update from vendor's website.

Bouncy Castle for Java - addressed in versions 1.80.2, 1.81.1, 1.84
Fusion Content-Aware Storage - update to 1.1.5
IBM Fusion HCI - update to 2.13.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.4.0 Patch 3
IBM Sterling Secure Proxy - addressed in versions 6.1.0.4 iFix01, 6.2.1.2.iFix02
IBM Sterling External Authentication Server - update to 6.1.1.3 iFix01
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.19, 6.4.0.8
IBM Sterling Control Center - addressed in versions 6.3.1.0.9, 6.4.1.0.3, 6.4.2.0.4
IBM Qradar SIEM - update to 7.5.0 Update Pack 15 IF05
IBM Business Automation Manager Open Editions - update to 8.0.9 IF0002
Jira Service Management Data Center - addressed in versions 10.3.13, 11.1.1
Jira Software Data Center - update to 10.3.13
bouncycastle - update to 1.84-150200.3.35.1
bouncycastle-pkix - update to 1.84-150200.3.35.1
bouncycastle-util - update to 1.84-150200.3.35.1
bouncycastle-pg - update to 1.84-150200.3.35.1
IBM Disconnected Log Collector - update to 2.0.1
Data Cataloging - update to 2.5.3
IBM Cloud Object Storage Systems - addressed in versions 3.20.0.91, 3.20.1.84
Red Hat build of Quarkus - addressed in versions 3.20.6.SP1, 3.27.3.SP1
Red Hat Camel for Spring Boot - update to 4.14

• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813
• https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f

• Multiple vulnerabilities in Bouncy Castle for Java
• Multiple vulnerabilities in Red Hat build of Quarkus 3.20.6
• Multiple vulnerabilities in Red Hat build of Quarkus 3.27.3
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
• SUSE update for bouncycastle
• Multiple vulnerabilities in IBM Control Center
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM ApplinX
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging, and IBM Fusion Content-Aware Storage
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Cloud Object Storage System
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Incorrect calculation in Jira Service Management Data Center
• Incorrect calculation in Jira Software Data Center
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM Sterling Secure Proxy