{"cve":"CVE-2019-11840","nvd":{"published":"2019-05-09T16:29:00.607","modified":"2026-06-17T02:13:43.400","status":"Analyzed","description":"An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa packages. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9},"cwes":["CWE-330"],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=1691529","https://github.com/golang/go/issues/30965","https://go.googlesource.com/crypto/+/b7391e95e576cacdcdd422573063bc057239113d","https://groups.google.com/forum/#%21msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ","https://lists.debian.org/debian-lts-announce/2019/06/msg00029.html"],"products":["debian:debian_linux","golang:crypto"],"source":"nvd","synced_at":"2026-10-19T20:56:19.218283075+00:00"},"epss":{"cve":"CVE-2019-11840","score":0.03452,"percentile":0.89019,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-r5c5-pr8j-pfp7","url":"https://osv.dev/vulnerability/GHSA-r5c5-pr8j-pfp7","summary":"golang.org/x/crypto/salsa20/salsa uses insufficiently random values","modified":"2026-09-10T03:49:36.602783909Z","packages":[{"ecosystem":"Go","name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto","ranges":["<0.0.0-20190320223903-b7391e95e576"],"fixed":["0.0.0-20190320223903-b7391e95e576"]}]},{"id":"GO-2022-0209","url":"https://osv.dev/vulnerability/GO-2022-0209","summary":"Insufficiently random values in golang.org/x/crypto/salsa20","modified":"2026-02-04T04:34:27.332878Z","packages":[{"ecosystem":"Go","name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto","ranges":["<0.0.0-20190320223903-b7391e95e576"],"fixed":["0.0.0-20190320223903-b7391e95e576"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}