CVE-2025-14813

Aliases:GHSA-574f-3g2m-x479CGA-2mrq-8cfw-fq57CGA-2v97-jh99-qmxmCGA-46g9-vcf4-2qw4CGA-59xp-677c-5qqcCGA-5f4g-mjq8-m3xxCGA-7v2x-jxpp-4hvxCGA-859f-hvmf-m55gCGA-87f6-r4p9-p6gfCGA-8j3j-jqp2-2xvgCGA-8m43-5fv8-6jcjCGA-8w55-4jrf-3jjpCGA-9gp7-x2xg-5qj9CGA-9p2c-xmch-769rCGA-cmjh-8vx8-24c9CGA-cv9q-j99x-r5x2CGA-g29v-2226-6527CGA-gv3g-qhvm-h7pcCGA-jhg4-99v2-fx9wCGA-mgx2-hx9c-q4rfCGA-mm7p-hgh8-2qg3CGA-p2gc-7h87-6mj6CGA-22gc-7759-3f33CGA-2pq2-6pgm-w82fCGA-2wg5-cq5p-p7ppCGA-39m9-864h-3gfjCGA-3c5v-w823-hpqjCGA-3fxx-45q7-7q49CGA-3gqw-9vgj-hww8CGA-3pr6-rfgw-m2v6CGA-44m7-pqmv-7mxmCGA-4532-95g3-h3qgCGA-4hhj-824v-8vv3CGA-4w5r-jcvp-582wCGA-4xm2-hfwp-vw6wCGA-5gfr-xhg9-qqqjCGA-5j66-j78j-w778CGA-5qmx-vmfc-mgw2CGA-6cjf-8xj3-cpj7CGA-6mgc-57p9-wcr7CGA-6mhw-9735-g2p6CGA-77fh-2f44-3833CGA-7rc4-3jr9-wfmpCGA-88gw-fh2q-x87qCGA-8fw8-v75q-9pcjCGA-8p43-4vh9-35q4CGA-8qmc-j59q-q4fwCGA-8rhm-6c7g-822gCGA-922h-5m9g-2xx6CGA-948m-2jvf-4xh7CGA-9cqq-g725-jg82CGA-9ggp-3xgw-prc3CGA-9ggw-q42r-9m83CGA-9prr-8wqw-wgqxCGA-c4xx-3j2g-p5r5CGA-c5hc-hfjf-pqrqCGA-cx5m-qppc-hfr9CGA-cxvf-q26x-f2qrCGA-cxvq-6jhj-8vqqCGA-f65v-fvrj-6f7jCGA-f7m6-qv35-xhcgCGA-fc63-mv7v-47m3CGA-fhfp-8p2q-rq78CGA-fhgp-6xq6-7qjfCGA-fpcq-33gp-7q8xCGA-fx3w-3624-xp6vCGA-g23m-2prr-wm4jCGA-g8xv-63jm-rf3hCGA-ggg7-73wc-rhrrCGA-gggv-xq8r-phhqCGA-gvgh-69r8-qfrvCGA-hc26-pp98-vwwxCGA-hc6r-9g75-7pv6CGA-hhcc-6v68-g8x5CGA-hvvr-2pq7-w3hwCGA-hxj6-rv7x-pgr8CGA-j42m-9cmg-6xw4CGA-j4hm-72w6-q9vxCGA-jqq5-9j4x-ww8xCGA-jr6r-jg42-6wwcCGA-m53j-7w49-84x9CGA-mrrv-7qx2-rwqpCGA-q346-f5x2-4pfgCGA-q465-xgrj-76jhCGA-q4r9-pvvw-c7x9CGA-qfj3-j8gw-w8prCGA-qhr6-vg9r-286cCGA-qjh6-ph56-r69gCGA-qq8j-9g4q-9j3wCGA-qv7r-p966-mh77CGA-r425-4hfx-gpjfCGA-r5pp-gwh3-5xm4CGA-rf87-h82g-c92mCGA-rw74-fc62-hgmpCGA-v27f-c7h2-vf74CGA-v2c8-xhqc-r4qcCGA-v2mx-gr6p-wvf4CGA-v7rw-r39w-9fgpCGA-v9vr-cfxw-fw46CGA-vphp-cww3-g5j7CGA-vq3p-f3x8-fjx3CGA-w77q-r3gr-4x9gCGA-w8mf-9x7v-2h2gCGA-wgpq-mvfh-w333CGA-wm2g-2272-g5mqCGA-wr79-ggwx-w622CGA-wv7p-hpjp-jg9mCGA-wwf4-q7x6-j7fhCGA-wwrg-8rwv-qfwgCGA-wx6w-g6h9-pgxvCGA-x692-7c4r-65gwCGA-x7j6-j3fc-vrcpCGA-x7vq-c2vp-65wjCGA-xfv6-pmqq-5fw2CGA-xw69-hg9v-xqghCGA-9jc2-6fhm-gwvgCGA-fr79-8h3r-rxr4CGA-m2qc-qg8r-xfm5CGA-p3pw-8h54-w4xcCGA-p559-64h8-f587CGA-rwjv-5v5w-77q5CGA-wqf6-5f6m-v92pCGA-xr7r-j7mw-cc27CGA-xwvc-3q8f-c74pCGA-3r7f-234m-vq6rCGA-692x-gwm8-p27wCGA-8q89-29fx-74v8CGA-cr3c-g3v5-c2v9CGA-hx88-v9mf-vp8fCGA-j4fh-4rh8-pmfvCGA-j64q-jvg8-2g89CGA-j755-c3gv-66vjCGA-pf7q-g94g-fq87CGA-rmm2-6fq7-jm6qCGA-whwp-6c43-f9f9CGA-wwp3-wgrq-cp5gCGA-x3w3-6wwc-rw7gCGA-2v99-px86-vw36CGA-5j9x-q8wx-f44qCGA-97wr-gqp9-797pCGA-994v-8942-p4fxCGA-9m2c-w4jh-5v3gCGA-c958-8696-2j8jCGA-cwgq-hv67-5p4mCGA-gfv3-967m-p5mwCGA-gpgf-hx93-2337CGA-gx2j-29pq-wwqfCGA-hc8j-57wp-vrhmCGA-hpm4-rwmf-8q6hCGA-jqrj-5vjr-9x4wCGA-p53f-22c4-669fCGA-pcjv-72mh-9j3cCGA-vwv8-p65h-hqmvCGA-wp8c-fpwx-rwg7CGA-x753-q5jr-fj46
Advisory lineage Upstream: 0 Downstream: 7
Awaiting Analysis
Published: 15 Apr 2026, 08:56
Last modified:18 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.3 CRITICAL
v4.0 (cve.org)
EPSS Score
0.32% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Apr 2026, 08:56
Published
Vulnerability first disclosed
18 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

CVSS Metrics

  • v4.0•CRITICAL•Score: 9.3CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red
  • v4.0•CRITICAL•Score: 9.3CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.32%• Percentile: 25%

Techniques & Countermeasures

  • CWE-327•Use of a Broken or Risky Cryptographic Algorithm

    The product uses a broken or risky cryptographic algorithm or protocol.

Affected Systems

  • chainguard•apache-pulsar-4.1

    all

  • chainguard•camunda-zeebe-8.6

    all

  • chainguard•commercial-elasticsearch-8.17

    all

  • chainguard•commercial-elasticsearch-9.1

    all

  • chainguard•commercial-elasticsearch-9.2

    all

  • chainguard•eco-java-gradle-7.6.5

    all

  • chainguard•eco-java-gradle-7.6.6

    all

  • chainguard•eco-java-gradle-8.10

    all

  • chainguard•eco-java-gradle-8.10.1

    all

  • chainguard•eco-java-gradle-8.10.2

    all

  • chainguard•eco-java-gradle-8.11

    all

  • chainguard•eco-java-gradle-8.11.1

    all

  • chainguard•eco-java-gradle-8.12

    all

  • chainguard•eco-java-gradle-8.12.1

    all

  • chainguard•eco-java-gradle-8.13

    all

  • chainguard•eco-java-gradle-8.14

    all

  • chainguard•eco-java-gradle-8.14.1

    all

  • chainguard•eco-java-gradle-8.14.2

    all

  • chainguard•eco-java-gradle-8.14.3

    all

  • chainguard•eco-java-gradle-8.14.4

    all

  • chainguard•eco-java-gradle-8.8

    all

  • chainguard•eco-java-gradle-8.9

    all

  • chainguard•eco-java-gradle-9.0.0

    all

  • chainguard•eco-java-gradle-9.1.0

    all

  • chainguard•eco-java-gradle-9.2.0

    all

  • chainguard•eco-java-gradle-9.2.1

    all

  • chainguard•eco-java-gradle-9.3.0

    all

  • chainguard•eco-java-gradle-9.3.1

    all

  • chainguard•eco-java-gradle-9.4.0

    all

  • chainguard•eco-java-gradle-9.4.1

    all

  • chainguard•hadoop-fips-3.4.2

    < 3.4.2-r5

  • chainguard•jenkins-2.528-openjdk-17

    all

  • chainguard•jenkins-2.528-openjdk-21

    all

  • chainguard•jenkins-2.541

    all

  • chainguard•jenkins-2.541-openjdk-17

    all

  • chainguard•jenkins-2.541-openjdk-21

    all

  • chainguard•jenkins-2.541-openjdk-25

    all

  • chainguard•kayenta-2025.2

    all

  • chainguard•kayenta-fips-2025.2

    all

  • chainguard•keycloak-26.4

    all

  • chainguard•keycloak-26.4-iamguarded-compat

    all

  • chainguard•keycloak-26.5

    all

  • chainguard•keycloak-26.5-iamguarded-compat

    all

  • chainguard•logstash-8.19

    < 8.19.19-r0

  • chainguard•logstash-8.19-iamguarded-compat

    < 8.19.19-r0

  • chainguard•logstash-8.19-with-output-opensearch

    < 8.19.19-r0

  • chainguard•logstash-9.1

    all

  • chainguard•logstash-9.1-bitnami-compat

    all

  • chainguard•logstash-9.1-iamguarded-compat

    all

  • chainguard•logstash-9.1-with-output-opensearch

    all

Showing first 50 affected entries in server-rendered view.

References (37)