The vulnerability CVE-2025-14813 in BC-JAVA's bcprov component affects the GOSTCTR implementation, specifically the G3413CTRBlockCipher. It fails to securely process more than 255 blocks of data due to keystream reuse, violating fundamental confidentiality guarantees. Exploitation requires capturing ciphertext encrypted with the same key and IV beyond the 255-block limit, enabling cryptanalysis to recover plaintext data. The primary impact is loss of confidentiality of data protected by this cipher. Red Hat has released a security update (JBoss Enterprise Application Platform 8.1.6) that includes a fix for this vulnerability. Mitigation includes limiting encrypted data size per key/IV or transitioning to a more secure authenticated encryption mode.

The vulnerability compromises the confidentiality of data encrypted using the GOSTCTR implementation in BC-JAVA when more than 255 blocks are processed under the same key and IV, allowing attackers to recover plaintext from captured ciphertext. There is no reported impact on integrity or availability. No known exploits in the wild have been reported at this time.

A security update is available and should be applied to affected systems, such as Red Hat JBoss Enterprise Application Platform 8.1.6 for RHEL 8. Until the update is applied, users should strictly limit the amount of data encrypted under a single key and IV pair with the GOSTCTR implementation to a maximum of 255 blocks. Alternatively, migrating to a more secure, standardized, and authenticated encryption mode is recommended.