This vulnerability (CVE-2025-14813) concerns the use of a broken or risky cryptographic algorithm in the BC-JAVA library by Legion of the Bouncy Castle Inc. The issue is specifically in the GOSTCTR block cipher implementation, which fails to correctly process more than 255 blocks. This flaw affects all core modules of BC-JAVA versions starting from 1.59 up to before 1.84. The vulnerability is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and has a critical CVSS 4.0 score of 9.4, reflecting high attack complexity and impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and no exploits are known in the wild.

The vulnerability compromises the cryptographic strength of the GOSTCTR implementation in BC-JAVA, potentially allowing attackers to undermine the confidentiality and integrity of data protected using this cipher. Because the implementation cannot correctly process more than 255 blocks, cryptographic operations may be weakened or fail, leading to risky cryptographic outcomes. The CVSS score of 9.4 indicates critical severity with high impact on system security. However, there are no known exploits reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding the use of the affected GOSTCTR implementation in BC-JAVA versions from 1.59 to before 1.84. Alternative cryptographic algorithms or updated library versions (1.84 or later) should be used once available. Monitor official Legion of the Bouncy Castle Inc. communications for patches or workarounds.