CVE-2019-19794

5.9 mediumEPSS 2.1%

The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

Severity

CVSS 3.1

5.9 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE: CWE-338
Published: 2019-12-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

miekg-dns_project:miekg-dns

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-44r7-7p62-q3fr	Go	github.com/miekg/dns	<1.1.25	1.1.25
GO-2020-0008	Go	github.com/miekg/dns	<1.1.25-0.20191211073109-8ebf2e419df7	1.1.25-0.20191211073109-8ebf2e419df7

References

https://github.com/coredns/coredns/issues/3519
https://github.com/coredns/coredns/issues/3547
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
https://github.com/miekg/dns/issues/1043
https://github.com/miekg/dns/pull/1044

Check your stack JSON