CVE-2025-14813High· 7.5▾ Twilight: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects B…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.3%
Last analysed / modified upstream
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).
This vulnerability is associated with program files G3413CTRBlockCipher.
This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.bouncycastle:bcprov-jdk14 >= 1.59, <= 1.80.1org.bouncycastle:bcprov-jdk15to18 >= 1.59, <= 1.80.1org.bouncycastle:bcprov-jdk18on >= 1.59, <= 1.80.1org.bouncycastle:bcprov-debug-jdk14 >= 1.59, <= 1.80.1org.bouncycastle:bcprov-debug-jdk15to18 >= 1.59, <= 1.80.1org.bouncycastle:bcprov-debug-jdk18on >= 1.59, <= 1.80.1org.bouncycastle:bcprov-ext-jdk14 >= 1.59, <= 1.78.1org.bouncycastle:bcprov-ext-jdk15to18 >= 1.59, <= 1.78.1org.bouncycastle:bcprov-ext-jdk18on >= 1.59, <= 1.78.1org.bouncycastle:bcprov-ext-debug-jdk14 >= 1.59, <= 1.74org.bouncycastle:bcprov-ext-debug-jdk15to18 >= 1.59, <= 1.77org.bouncycastle:bcprov-ext-debug-jdk18on >= 1.59, <= 1.77org.bouncycastle:bcprov-jdk14 = 1.81.0org.bouncycastle:bcprov-jdk15to18 = 1.81.0org.bouncycastle:bcprov-jdk18on = 1.81.0org.bouncycastle:bcprov-debug-jdk14 = 1.81.0org.bouncycastle:bcprov-debug-jdk15to18 = 1.81.0org.bouncycastle:bcprov-debug-jdk18on = 1.81.0org.bouncycastle:bcprov-jdk14 >= 1.82, <= 1.83org.bouncycastle:bcprov-jdk15to18 >= 1.82, <= 1.83org.bouncycastle:bcprov-jdk18on >= 1.82, <= 1.83org.bouncycastle:bcprov-debug-jdk14 >= 1.82, <= 1.83org.bouncycastle:bcprov-debug-jdk15to18 >= 1.82, <= 1.83org.bouncycastle:bcprov-debug-jdk18on >= 1.82, <= 1.83org.bouncycastle:bcprov-debug-jdk15on <= 1.7.0org.bouncycastle:bcprov-jdk15on <= 1.7.0Patched in:
org.bouncycastle:bcprov-jdk18on 1.80.2org.bouncycastle:bcprov-jdk18on 1.81.1org.bouncycastle:bcprov-jdk14 1.84org.bouncycastle:bcprov-jdk15to18 1.84org.bouncycastle:bcprov-jdk18on 1.84org.bouncycastle:bcprov-debug-jdk14 1.84org.bouncycastle:bcprov-debug-jdk15to18 1.84org.bouncycastle:bcprov-debug-jdk18on 1.84Source: https://github.com/advisories/GHSA-574f-3g2m-x479
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-5588High· 7.5Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc
CVE-2026-0636Medium· 6.5Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc
CVE-2026-5598High· 7.5Covert timing channel vulnerability in Legion of the Bouncy Castle Inc
CVE-2026-3505High· 7.5Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc
CVE-2026-71891High· 7.1In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key bui…
CVE-2026-18036High· 8.2In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency…