This vulnerability (CVE-2025-14813) concerns the use of a broken or risky cryptographic algorithm in the BC-JAVA library by Legion of the Bouncy Castle Inc., specifically in the GOSTCTR block cipher implementation (G3413CTRBlockCipher). The issue causes the implementation to fail when processing more than 255 blocks, potentially undermining cryptographic security. Affected versions include BC-JAVA from 1.59 before 1.80.2, from 1.81 before 1.81.1, and from 1.82 before 1.84. Red Hat has released security advisories and updates for their JBoss Enterprise Application Platform 8.1 for RHEL 8 that include fixes for this vulnerability. The CVSS 4.0 base score is 9.3, indicating critical severity with high impact on confidentiality, integrity, and system availability. No public exploits have been reported.

The vulnerability impacts the cryptographic integrity of the BC-JAVA library's GOSTCTR block cipher implementation, which is unable to correctly process more than 255 blocks. This weakness could lead to compromised cryptographic operations, potentially affecting confidentiality and integrity of data protected by this algorithm. The CVSS 4.0 score of 9.3 reflects critical severity with high impact on confidentiality, integrity, and availability. There are no known exploits in the wild currently, but the risk remains significant due to the nature of the cryptographic failure.

Red Hat has issued security advisories and updates that address this vulnerability in their JBoss Enterprise Application Platform 8.1 for RHEL 8. Users should apply the relevant security updates from Red Hat to remediate the issue. Before applying updates, ensure all previous errata are applied and back up existing installations. Patch status is confirmed by Red Hat advisories linked in the vendor advisory URLs. No additional mitigation steps are specified beyond applying the official fixes.