{"schema":"threatline.record/2","record":{"id":"CVE-2025-14813","aliases":["GHSA-574f-3g2m-x479"],"summary":"Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks","details":"The GOST 28147-2015 CTR mode implementation (`G3413CTRBlockCipher`) in the Legion of the Bouncy Castle BC-JAVA `bcprov` core module only increments the final byte of the counter, so the counter wraps after 255 blocks and the keystream is reused. Reusing CTR keystream allows an attacker who can observe two ciphertexts produced with the same key/IV to recover the XOR of the plaintexts, breaking confidentiality. Affects BC-JAVA from 1.59 before 1.84 (with backported fixes in 1.80.2 and 1.81.1).","categories":["Libraries & packages"],"product":"org.bouncycastle:bcprov-jdk14","vendor":"Legion of the Bouncy Castle Inc.","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk14"},"range":">= 1.59, <= 1.80.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk15to18"},"range":">= 1.59, <= 1.80.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk18on"},"range":">= 1.59, <= 1.80.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk14"},"range":">= 1.59, <= 1.80.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk15to18"},"range":">= 1.59, <= 1.80.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk18on"},"range":">= 1.59, <= 1.80.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-ext-jdk14"},"range":">= 1.59, <= 1.78.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-ext-jdk15to18"},"range":">= 1.59, <= 1.78.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-ext-jdk18on"},"range":">= 1.59, <= 1.78.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-ext-debug-jdk14"},"range":">= 1.59, <= 1.74"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-ext-debug-jdk15to18"},"range":">= 1.59, <= 1.77"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-ext-debug-jdk18on"},"range":">= 1.59, <= 1.77"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk14"},"range":"= 1.81.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk15to18"},"range":"= 1.81.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk18on"},"range":"= 1.81.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk14"},"range":"= 1.81.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk15to18"},"range":"= 1.81.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk18on"},"range":"= 1.81.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk14"},"range":">= 1.82, <= 1.83"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk15to18"},"range":">= 1.82, <= 1.83"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk18on"},"range":">= 1.82, <= 1.83"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk14"},"range":">= 1.82, <= 1.83"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk15to18"},"range":">= 1.82, <= 1.83"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk18on"},"range":">= 1.82, <= 1.83"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk15on"},"range":"<= 1.7.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk15on"},"range":"<= 1.7.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14813","source_modified_at":"2026-09-18T12:04:47.472Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"BC-JAVA","vendor":"Legion of the Bouncy Castle Inc.","versions":[{"status":"affected","version":"1.59","lessThan":"1.80.2","versionType":"maven"},{"status":"affected","version":"1.81","lessThan":"1.81.1","versionType":"maven"},{"status":"affected","version":"1.82","lessThan":"1.84","versionType":"maven"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk14","purl":"pkg:maven/org.bouncycastle/bcprov-jdk14"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.80.1"}],"type":"ECOSYSTEM"}],"versions":["1.59","1.60","1.61","1.62","1.63","1.64","1.65","1.67","1.68","1.69","1.70","1.71","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.78.1","1.79","1.80"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.80.1"}],"type":"ECOSYSTEM"}],"versions":["1.63","1.64","1.65","1.66","1.67","1.68","1.69","1.70","1.71","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.78.1","1.79","1.80"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on"},"ranges":[{"events":[{"introduced":"1.59"},{"fixed":"1.80.2"}],"type":"ECOSYSTEM"}],"versions":["1.71","1.71.1","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.78.1","1.79","1.80"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk14","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk14"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.80.1"}],"type":"ECOSYSTEM"}],"versions":["1.59","1.60","1.64","1.68","1.69","1.70","1.71","1.72","1.73","1.74","1.78","1.79","1.80"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.80.1"}],"type":"ECOSYSTEM"}],"versions":["1.64","1.68","1.69","1.70","1.71","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.78.1","1.79"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk18on"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.80.1"}],"type":"ECOSYSTEM"}],"versions":["1.71","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.78.1","1.79"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-ext-jdk14","purl":"pkg:maven/org.bouncycastle/bcprov-ext-jdk14"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.78.1"}],"type":"ECOSYSTEM"}],"versions":["1.60","1.64","1.65","1.67","1.68","1.69","1.70","1.71","1.72","1.73","1.75","1.76","1.78","1.78.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-ext-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-ext-jdk15to18"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.78.1"}],"type":"ECOSYSTEM"}],"versions":["1.64","1.67","1.68","1.69","1.70","1.71","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.78.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-ext-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-ext-jdk18on"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.78.1"}],"type":"ECOSYSTEM"}],"versions":["1.71","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.78.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-ext-debug-jdk14","purl":"pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk14"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.74"}],"type":"ECOSYSTEM"}],"versions":["1.60","1.68","1.69","1.70","1.71","1.72","1.73","1.74"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-ext-debug-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15to18"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.77"}],"type":"ECOSYSTEM"}],"versions":["1.68","1.69","1.70","1.71","1.72","1.73","1.74","1.75","1.76","1.77"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-ext-debug-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk18on"},"ranges":[{"events":[{"introduced":"1.59"},{"last_affected":"1.77"}],"type":"ECOSYSTEM"}],"versions":["1.71","1.72","1.73","1.74","1.75","1.76","1.77"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk14","purl":"pkg:maven/org.bouncycastle/bcprov-jdk14"},"ranges":[],"versions":["1.81.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18"},"ranges":[],"versions":["1.81.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on"},"ranges":[{"events":[{"introduced":"1.81.0"},{"fixed":"1.81.1"}],"type":"ECOSYSTEM"}],"versions":["1.81","1.81.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk14","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk14"},"ranges":[],"versions":["1.81.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18"},"ranges":[],"versions":["1.81.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk18on"},"ranges":[],"versions":["1.81.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk14","purl":"pkg:maven/org.bouncycastle/bcprov-jdk14"},"ranges":[{"events":[{"introduced":"1.82"},{"fixed":"1.84"}],"type":"ECOSYSTEM"}],"versions":["1.82","1.83"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18"},"ranges":[{"events":[{"introduced":"1.82"},{"fixed":"1.84"}],"type":"ECOSYSTEM"}],"versions":["1.82","1.83"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on"},"ranges":[{"events":[{"introduced":"1.82"},{"fixed":"1.84"}],"type":"ECOSYSTEM"}],"versions":["1.82","1.83"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk14","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk14"},"ranges":[{"events":[{"introduced":"1.82"},{"fixed":"1.84"}],"type":"ECOSYSTEM"}],"versions":["1.82","1.83"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18"},"ranges":[{"events":[{"introduced":"1.82"},{"fixed":"1.84"}],"type":"ECOSYSTEM"}],"versions":["1.82","1.83"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk18on"},"ranges":[{"events":[{"introduced":"1.82"},{"fixed":"1.84"}],"type":"ECOSYSTEM"}],"versions":["1.82","1.83"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk15on","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk15on"},"ranges":[{"events":[{"introduced":"0"},{"last_affected":"1.7.0"}],"type":"ECOSYSTEM"}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk15on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15on"},"ranges":[{"events":[{"introduced":"0"},{"last_affected":"1.7.0"}],"type":"ECOSYSTEM"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk18on"},"version":"1.80.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk18on"},"version":"1.81.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk14"},"version":"1.84"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk15to18"},"version":"1.84"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-jdk18on"},"version":"1.84"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk14"},"version":"1.84"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk15to18"},"version":"1.84"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:18:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.bouncycastle:bcprov-debug-jdk18on"},"version":"1.84"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14813","source_modified_at":"2026-09-18T12:04:47.472Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"BC-JAVA","ecosystem":null},"version":"1.80.2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14813","source_modified_at":"2026-09-18T12:04:47.472Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"BC-JAVA","ecosystem":null},"version":"1.81.1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14813","source_modified_at":"2026-09-18T12:04:47.472Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"BC-JAVA","ecosystem":null},"version":"1.84","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on"},"version":"1.80.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on"},"version":"1.81.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk14","purl":"pkg:maven/org.bouncycastle/bcprov-jdk14"},"version":"1.84"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18"},"version":"1.84"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on"},"version":"1.84"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk14","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk14"},"version":"1.84"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18"},"version":"1.84"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","source_modified_at":"2026-09-24T15:30:06.452617383Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-debug-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-debug-jdk18on"},"version":"1.84"}],"cvss":9.3,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.0032,"percentile":0.23732,"score_date":"2026-10-23"},"published_at":"2026-04-15T08:56:34.057Z","modified_at":"2026-09-24T15:30:06.452617383Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-574f-3g2m-x479","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-24T15:18:46Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-14813","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-18T12:04:47.472Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-574f-3g2m-x479","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-24T15:30:06.452617383Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-14813","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14813","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3","tags":["patch"]},{"source":"CVE List","url":"https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f","tags":["patch"]},{"source":"CVE List","url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json","tags":["x_sadp-csaf-vex"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458640","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2025-14813","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:24977","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:21772","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:18059","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:18055","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:18054","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:17668","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14276","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:14272","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13631","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:11721","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:11720","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60247","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60248","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60249","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60250","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60251","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60252","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60254","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60256","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60259","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:53644","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:53645","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:53646","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53806","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60239","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:60246","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://github.com/advisories/GHSA-574f-3g2m-x479","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-04-15T13:19:43.094033Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-24T15:30:06.452617383Z","content_hash":"f582327e7c8906c93922d5ffbd4f9339b03403a24724fa30069f3d64204a0f3e"}}