mirrored from https://www.bouncycastle.org/repositories/bc-java
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
CVE‐2025‐14813
David Hook edited this page May 18, 2026
·
6 revisions
Title: : GOSTCTR implementation unable to process more than 255 blocks correctly
Issue affecting: BC 1.59 to 1.80.1, BC 1.81, BC 1.82 to BC 1.83.
Fixed versions: BC 1.80.2, BC 1.81.1, BC 1.84
Platform affected: Java 4 and later.
The GOST-R-3413-2015 CTR implementation in G3413CTRBlockCipher was using a single byte as a counter, resulting in the mode being unable to encrypt or decrypt more than 255 blocks. This is somewhat below the algorithm definition which says the counter should allow for n/2 bits where n is the block size of the cipher in use.
Fixes for this were introduced in commit b42574345414e4b7c8051b16fa1fafe01c29871f and commit 701686cb0184cd9ae103c801b3581fdf95c6d4f3.