CriticalFix available

Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

Type: advisorySource: OSV1 source record

The GOST 28147-2015 CTR mode implementation (`G3413CTRBlockCipher`) in the Legion of the Bouncy Castle BC-JAVA `bcprov` core module only increments the final byte of the counter, so the counter wraps after 255 blocks and the keystream is reused. Reusing CTR keystream allows an attacker who can observe two ciphertexts produced with the same key/IV to recover the XOR of the plaintexts, breaking confidentiality. Affects BC-JAVA from 1.59 before 1.84 (with backported fixes in 1.80.2 and 1.81.1).

Announced 17 Apr 2026Group revision 1

Original source ↗

GHSA-574f-3g2m-x479

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-574f-3g2m-x479

org.bouncycastle:bcprov-jdk14

Source reference: /affected/0/package/name

Affected versions: 1.59
Source reference: /affected/0/versions
1.60
Source reference: /affected/0/versions
1.61
Source reference: /affected/0/versions
1.62
Source reference: /affected/0/versions
1.63
Source reference: /affected/0/versions
1.64
Source reference: /affected/0/versions
1.65
Source reference: /affected/0/versions
1.67
Source reference: /affected/0/versions
1.68
Source reference: /affected/0/versions
1.69
Source reference: /affected/0/versions
1.70
Source reference: /affected/0/versions
1.71
Source reference: /affected/0/versions
1.72
Source reference: /affected/0/versions
1.73
Source reference: /affected/0/versions
1.74
Source reference: /affected/0/versions
1.75
Source reference: /affected/0/versions
1.76
Source reference: /affected/0/versions
1.77
Source reference: /affected/0/versions
1.78
Source reference: /affected/0/versions
1.78.1
Source reference: /affected/0/versions
1.79
Source reference: /affected/0/versions
1.80
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-jdk15to18

Source reference: /affected/1/package/name

Affected versions: 1.63
Source reference: /affected/1/versions
1.64
Source reference: /affected/1/versions
1.65
Source reference: /affected/1/versions
1.66
Source reference: /affected/1/versions
1.67
Source reference: /affected/1/versions
1.68
Source reference: /affected/1/versions
1.69
Source reference: /affected/1/versions
1.70
Source reference: /affected/1/versions
1.71
Source reference: /affected/1/versions
1.72
Source reference: /affected/1/versions
1.73
Source reference: /affected/1/versions
1.74
Source reference: /affected/1/versions
1.75
Source reference: /affected/1/versions
1.76
Source reference: /affected/1/versions
1.77
Source reference: /affected/1/versions
1.78
Source reference: /affected/1/versions
1.78.1
Source reference: /affected/1/versions
1.79
Source reference: /affected/1/versions
1.80
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-jdk18on

Source reference: /affected/2/package/name

Affected versions: 1.71
Source reference: /affected/2/versions
1.71.1
Source reference: /affected/2/versions
1.72
Source reference: /affected/2/versions
1.73
Source reference: /affected/2/versions
1.74
Source reference: /affected/2/versions
1.75
Source reference: /affected/2/versions
1.76
Source reference: /affected/2/versions
1.77
Source reference: /affected/2/versions
1.78
Source reference: /affected/2/versions
1.78.1
Source reference: /affected/2/versions
1.79
Source reference: /affected/2/versions
1.80
Source reference: /affected/2/versions
Fixed versions: 1.80.2
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-debug-jdk14

Source reference: /affected/3/package/name

Affected versions: 1.59
Source reference: /affected/3/versions
1.60
Source reference: /affected/3/versions
1.64
Source reference: /affected/3/versions
1.68
Source reference: /affected/3/versions
1.69
Source reference: /affected/3/versions
1.70
Source reference: /affected/3/versions
1.71
Source reference: /affected/3/versions
1.72
Source reference: /affected/3/versions
1.73
Source reference: /affected/3/versions
1.74
Source reference: /affected/3/versions
1.78
Source reference: /affected/3/versions
1.79
Source reference: /affected/3/versions
1.80
Source reference: /affected/3/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-debug-jdk15to18

Source reference: /affected/4/package/name

Affected versions: 1.64
Source reference: /affected/4/versions
1.68
Source reference: /affected/4/versions
1.69
Source reference: /affected/4/versions
1.70
Source reference: /affected/4/versions
1.71
Source reference: /affected/4/versions
1.72
Source reference: /affected/4/versions
1.73
Source reference: /affected/4/versions
1.74
Source reference: /affected/4/versions
1.75
Source reference: /affected/4/versions
1.76
Source reference: /affected/4/versions
1.77
Source reference: /affected/4/versions
1.78
Source reference: /affected/4/versions
1.78.1
Source reference: /affected/4/versions
1.79
Source reference: /affected/4/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-debug-jdk18on

Source reference: /affected/5/package/name

Affected versions: 1.71
Source reference: /affected/5/versions
1.72
Source reference: /affected/5/versions
1.73
Source reference: /affected/5/versions
1.74
Source reference: /affected/5/versions
1.75
Source reference: /affected/5/versions
1.76
Source reference: /affected/5/versions
1.77
Source reference: /affected/5/versions
1.78
Source reference: /affected/5/versions
1.78.1
Source reference: /affected/5/versions
1.79
Source reference: /affected/5/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-ext-jdk14

Source reference: /affected/6/package/name

Affected versions: 1.60
Source reference: /affected/6/versions
1.64
Source reference: /affected/6/versions
1.65
Source reference: /affected/6/versions
1.67
Source reference: /affected/6/versions
1.68
Source reference: /affected/6/versions
1.69
Source reference: /affected/6/versions
1.70
Source reference: /affected/6/versions
1.71
Source reference: /affected/6/versions
1.72
Source reference: /affected/6/versions
1.73
Source reference: /affected/6/versions
1.75
Source reference: /affected/6/versions
1.76
Source reference: /affected/6/versions
1.78
Source reference: /affected/6/versions
1.78.1
Source reference: /affected/6/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-ext-jdk15to18

Source reference: /affected/7/package/name

Affected versions: 1.64
Source reference: /affected/7/versions
1.67
Source reference: /affected/7/versions
1.68
Source reference: /affected/7/versions
1.69
Source reference: /affected/7/versions
1.70
Source reference: /affected/7/versions
1.71
Source reference: /affected/7/versions
1.72
Source reference: /affected/7/versions
1.73
Source reference: /affected/7/versions
1.74
Source reference: /affected/7/versions
1.75
Source reference: /affected/7/versions
1.76
Source reference: /affected/7/versions
1.77
Source reference: /affected/7/versions
1.78
Source reference: /affected/7/versions
1.78.1
Source reference: /affected/7/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-ext-jdk18on

Source reference: /affected/8/package/name

Affected versions: 1.71
Source reference: /affected/8/versions
1.72
Source reference: /affected/8/versions
1.73
Source reference: /affected/8/versions
1.74
Source reference: /affected/8/versions
1.75
Source reference: /affected/8/versions
1.76
Source reference: /affected/8/versions
1.77
Source reference: /affected/8/versions
1.78
Source reference: /affected/8/versions
1.78.1
Source reference: /affected/8/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-ext-debug-jdk14

Source reference: /affected/9/package/name

Affected versions: 1.60
Source reference: /affected/9/versions
1.68
Source reference: /affected/9/versions
1.69
Source reference: /affected/9/versions
1.70
Source reference: /affected/9/versions
1.71
Source reference: /affected/9/versions
1.72
Source reference: /affected/9/versions
1.73
Source reference: /affected/9/versions
1.74
Source reference: /affected/9/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-ext-debug-jdk15to18

Source reference: /affected/10/package/name

Affected versions: 1.68
Source reference: /affected/10/versions
1.69
Source reference: /affected/10/versions
1.70
Source reference: /affected/10/versions
1.71
Source reference: /affected/10/versions
1.72
Source reference: /affected/10/versions
1.73
Source reference: /affected/10/versions
1.74
Source reference: /affected/10/versions
1.75
Source reference: /affected/10/versions
1.76
Source reference: /affected/10/versions
1.77
Source reference: /affected/10/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-ext-debug-jdk18on

Source reference: /affected/11/package/name

Affected versions: 1.71
Source reference: /affected/11/versions
1.72
Source reference: /affected/11/versions
1.73
Source reference: /affected/11/versions
1.74
Source reference: /affected/11/versions
1.75
Source reference: /affected/11/versions
1.76
Source reference: /affected/11/versions
1.77
Source reference: /affected/11/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-jdk14

Source reference: /affected/12/package/name

Affected versions: 1.81.0
Source reference: /affected/12/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-jdk15to18

Source reference: /affected/13/package/name

Affected versions: 1.81.0
Source reference: /affected/13/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-jdk18on

Source reference: /affected/14/package/name

Affected versions: 1.81
Source reference: /affected/14/versions
1.81.0
Source reference: /affected/14/versions
Fixed versions: 1.81.1
Source reference: /affected/14/ranges
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-debug-jdk14

Source reference: /affected/15/package/name

Affected versions: 1.81.0
Source reference: /affected/15/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-debug-jdk15to18

Source reference: /affected/16/package/name

Affected versions: 1.81.0
Source reference: /affected/16/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-debug-jdk18on

Source reference: /affected/17/package/name

Affected versions: 1.81.0
Source reference: /affected/17/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-jdk14

Source reference: /affected/18/package/name

Affected versions: 1.82
Source reference: /affected/18/versions
1.83
Source reference: /affected/18/versions
Fixed versions: 1.84
Source reference: /affected/18/ranges
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-jdk15to18

Source reference: /affected/19/package/name

Affected versions: 1.82
Source reference: /affected/19/versions
1.83
Source reference: /affected/19/versions
Fixed versions: 1.84
Source reference: /affected/19/ranges
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-jdk18on

Source reference: /affected/20/package/name

Affected versions: 1.82
Source reference: /affected/20/versions
1.83
Source reference: /affected/20/versions
Fixed versions: 1.84
Source reference: /affected/20/ranges
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-debug-jdk14

Source reference: /affected/21/package/name

Affected versions: 1.82
Source reference: /affected/21/versions
1.83
Source reference: /affected/21/versions
Fixed versions: 1.84
Source reference: /affected/21/ranges
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-debug-jdk15to18

Source reference: /affected/22/package/name

Affected versions: 1.82
Source reference: /affected/22/versions
1.83
Source reference: /affected/22/versions
Fixed versions: 1.84
Source reference: /affected/22/ranges
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-debug-jdk18on

Source reference: /affected/23/package/name

Affected versions: 1.82
Source reference: /affected/23/versions
1.83
Source reference: /affected/23/versions
Fixed versions: 1.84
Source reference: /affected/23/ranges
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-debug-jdk15on

Source reference: /affected/24/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

org.bouncycastle:bcprov-jdk15on

Source reference: /affected/25/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.80.1"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-jdk14",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk14",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.59",
      "1.60",
      "1.61",
      "1.62",
      "1.63",
      "1.64",
      "1.65",
      "1.67",
      "1.68",
      "1.69",
      "1.70",
      "1.71",
      "1.72",
      "1.73",
      "1.74",
      "1.75",
      "1.76",
      "1.77",
      "1.78",
      "1.78.1",
      "1.79",
      "1.80"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.80.1"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-jdk15to18",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk15to18",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.63",
      "1.64",
      "1.65",
      "1.66",
      "1.67",
      "1.68",
      "1.69",
      "1.70",
      "1.71",
      "1.72",
      "1.73",
      "1.74",
      "1.75",
      "1.76",
      "1.77",
      "1.78",
      "1.78.1",
      "1.79",
      "1.80"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "fixed": "1.80.2"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.71",
      "1.71.1",
      "1.72",
      "1.73",
      "1.74",
      "1.75",
      "1.76",
      "1.77",
      "1.78",
      "1.78.1",
      "1.79",
      "1.80"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json",
      "last_known_affected_version_range": "<= 1.80.1"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.80.1"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-debug-jdk14",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk14",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.59",
      "1.60",
      "1.64",
      "1.68",
      "1.69",
      "1.70",
      "1.71",
      "1.72",
      "1.73",
      "1.74",
      "1.78",
      "1.79",
      "1.80"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.80.1"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-debug-jdk15to18",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.64",
      "1.68",
      "1.69",
      "1.70",
      "1.71",
      "1.72",
      "1.73",
      "1.74",
      "1.75",
      "1.76",
      "1.77",
      "1.78",
      "1.78.1",
      "1.79"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.80.1"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-debug-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.71",
      "1.72",
      "1.73",
      "1.74",
      "1.75",
      "1.76",
      "1.77",
      "1.78",
      "1.78.1",
      "1.79"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.78.1"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-ext-jdk14",
      "purl": "pkg:maven/org.bouncycastle/bcprov-ext-jdk14",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.60",
      "1.64",
      "1.65",
      "1.67",
      "1.68",
      "1.69",
      "1.70",
      "1.71",
      "1.72",
      "1.73",
      "1.75",
      "1.76",
      "1.78",
      "1.78.1"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.78.1"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-ext-jdk15to18",
      "purl": "pkg:maven/org.bouncycastle/bcprov-ext-jdk15to18",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.64",
      "1.67",
      "1.68",
      "1.69",
      "1.70",
      "1.71",
      "1.72",
      "1.73",
      "1.74",
      "1.75",
      "1.76",
      "1.77",
      "1.78",
      "1.78.1"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.78.1"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-ext-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-ext-jdk18on",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.71",
      "1.72",
      "1.73",
      "1.74",
      "1.75",
      "1.76",
      "1.77",
      "1.78",
      "1.78.1"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.74"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-ext-debug-jdk14",
      "purl": "pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk14",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.60",
      "1.68",
      "1.69",
      "1.70",
      "1.71",
      "1.72",
      "1.73",
      "1.74"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.77"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-ext-debug-jdk15to18",
      "purl": "pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15to18",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.68",
      "1.69",
      "1.70",
      "1.71",
      "1.72",
      "1.73",
      "1.74",
      "1.75",
      "1.76",
      "1.77"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.59"
          },
          {
            "last_affected": "1.77"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-ext-debug-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk18on",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.71",
      "1.72",
      "1.73",
      "1.74",
      "1.75",
      "1.76",
      "1.77"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "package": {
      "name": "org.bouncycastle:bcprov-jdk14",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk14",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.81.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "package": {
      "name": "org.bouncycastle:bcprov-jdk15to18",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk15to18",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.81.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.81.0"
          },
          {
            "fixed": "1.81.1"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.81",
      "1.81.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "package": {
      "name": "org.bouncycastle:bcprov-debug-jdk14",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk14",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.81.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "package": {
      "name": "org.bouncycastle:bcprov-debug-jdk15to18",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.81.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "package": {
      "name": "org.bouncycastle:bcprov-debug-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.81.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.82"
          },
          {
            "fixed": "1.84"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-jdk14",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk14",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.82",
      "1.83"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json",
      "last_known_affected_version_range": "<= 1.83"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.82"
          },
          {
            "fixed": "1.84"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-jdk15to18",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk15to18",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.82",
      "1.83"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json",
      "last_known_affected_version_range": "<= 1.83"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.82"
          },
          {
            "fixed": "1.84"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.82",
      "1.83"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json",
      "last_known_affected_version_range": "<= 1.83"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.82"
          },
          {
            "fixed": "1.84"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-debug-jdk14",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk14",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.82",
      "1.83"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json",
      "last_known_affected_version_range": "<= 1.83"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.82"
          },
          {
            "fixed": "1.84"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-debug-jdk15to18",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.82",
      "1.83"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json",
      "last_known_affected_version_range": "<= 1.83"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.82"
          },
          {
            "fixed": "1.84"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-debug-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.82",
      "1.83"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json",
      "last_known_affected_version_range": "<= 1.83"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "1.7.0"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-debug-jdk15on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk15on",
      "ecosystem": "Maven"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "1.7.0"
          }
        ]
      }
    ],
    "package": {
      "name": "org.bouncycastle:bcprov-jdk15on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk15on",
      "ecosystem": "Maven"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json"
    }
  }
]

Related CVEs: CVE-2025-14813
Source reference: /aliases

Publisher severity

critical

Source reference: /database_specific/severity

Event: #13834 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:31:27 GMT
Publisher date: Fri, 17 Apr 2026 18:31:50 GMT

Read the original announcement

Revision history

25 Oct 2026GHSA-574f-3g2m-x479 · Revision 1Source updated