CVE-2025-14813

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

TuxCare rebuilt 9 org.bouncycastle packages to address 1 CVE. Fixed in 1.78.1-tuxcare.3.

TuxCare rebuilt 9 org.bouncycastle packages to address 1 CVE. Fixed in 1.77-tuxcare.1.

TuxCare rebuilt 3 org.bouncycastle packages to address 1 CVE. Fixed in 1.64-tuxcare.6.

TuxCare rebuilt 6 org.bouncycastle packages to address 4 CVEs. Fixed in 1.76-tuxcare.4.

TuxCare rebuilt 21 org.bouncycastle packages to address 9 CVEs. Fixed in 1.75-tuxcare.1.

These are all security issues fixed in the bouncycastle-1.84-1.1 package on the GA media of openSUSE Tumbleweed.

This update for bouncycastle fixes the following issues:

• Update to version 1.84:
• CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).
• CVE-2026-0636: LDAP Injection Vulnerability in LDAPStoreHelper.java (bsc#1262226).
• CVE-2026-3505: Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).
• CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).
• CVE-2026-5598: Non-constant time comparisons risk private key leakage in FrodoKEM (bsc#1262227).

Root has patched CVE-2025-14813 in the org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available.

This update for bouncycastle fixes the following issues:

Update to version 1.84.

Security issues fixed:

• CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).
• CVE-2026-0636: LDAP injection in LDAPStoreHelper.java leads to information disclosure (bsc#1262226).
• CVE-2026-3505: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).
• CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).
• CVE-2026-5598: non-constant time comparisons risks private key leakage in FrodoKEM (bsc#1262227).

Other updates and bugfixes:

• Version 1.84:
  • In line with JVM changes, KEM support has been backported to Java 17.
  • BCJSSE: Configurable (client) early key_share groups via BCSSLParameters.earlyKeyShares or 'org.bouncycastle.jsse.client.earlyKeyShares' system property.
  • BCJSSE: Support for curveSM2MLKEM768 hybrid NamedGroup in TLS 1.3 per draft-yang-tls-hybrid-sm2-mlkem-03.
  • BCJSSE: Log when default cipher suites are disabled.
  • BCJSSE: Experimental support for ShangMi crypto in TLS 1.3 per RFC 8998 (not enabled by default).
  • CMS: Added CMSAuthEnvelopedDataStreamGenerator.open taking an explicit content type.
  • HKDF: Provider support for HKDFParameterSpec.Expand.
  • Added initial support for RFC 9380 (Hashing to Elliptic Curves); see org.bouncycastle.crypto.hash2curve .
  • PKCS12: Added default max iteration count of 5,000,000 (configurable via 'org.bouncycastle.pkcs12.max_it_count' property).
  • TLS: Use javax.crypto.KEM API (when available) to access ML-KEM implementation (incl. hybrids).
  • A new KeyStore, PKCS12-PBMAC1, has been added which defaults to using PBMAC1 and supports RFC 9879.
  • A new property 'org.bouncycastle.asn1.max_cons_depth' has been added to allow setting of the maximum nesting for SETs/SEQUENCESs in ASN.1. Default is 32.
  • A new property 'org.bouncycastle.asn1.max_limit' has been added to allow setting of the stream size of ASN.1 encodings. The value can be either in bytes, or appended with k (1 kilobyte blocks), m (1 megabyte blocks), or g (1 gigabyte blocks).
  • Added NTRU+ support to the lightweight PQC API and the BCPQC provider.
  • Added SM4 key wrap/unwrap mode, SM2 key exchange, and logging to SM2Signer.
  • OpenPGP: Added encryption-key filtering by purpose, a new OpenPGPKey constructor, KeyPassphraseProvider-based passphrase change, wildcard (anonymous) recipient handling, and Web-of-Trust methods for third-party signature chains and delegations.
  • CMSSignedDataStreamGenerator can now support the generation of DER/DL encoded SignedData objects (note memory restrictions still apply).
  • It is now possible to add extra digest alorithm IDs to CMSSignedDataStreamGenerator when required.
  • Random numbers being generated for DSTU4145 signature calculations were 1 bit shorter than they could be. The code has been corrected to allow the generated numbers to occupy the full numeric range available.
  • HKDF implementation has been corrected to use multiple IKMs if available.
  • CompositePublic/PrivateKey builders had an issue identifying brainpool and EdDSA curves from the algorithm names due to an error in the OID mapping table. This has been fixed.
  • S/MIME: Fix AuthEnveloped support for AES192/GCM and AES256/GCM.
  • CMS: Use implicit tag for AuthEnvelopedData.authEncryptedContentInfo.encryptedContent.
  • Fixed Strings.split to handle delimiters at position 0.
  • Fixed FrodoKEM error sampling to be constant-time.
  • Fixed PKIXNameConstraintValidator to treat a DNS name as intersecting itself.
  • Fixed PKCS12 key stores not calling getInstance with the original provider (which was forcing provider registration).
  • A resource leak due to the SMIMESigned constructor leaving background threads hanging on MessagingException has been fixed.
  • OpenPGP:…

This update for bouncycastle fixes the following issues:

• Update to version 1.84:
• CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).
• CVE-2026-0636: LDAP Injection Vulnerability in LDAPStoreHelper.java (bsc#1262226).
• CVE-2026-3505: Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).
• CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).
• CVE-2026-5598: Non-constant time comparisons risk private key leakage in FrodoKEM (bsc#1262227).