GHSA-gv9j-4w24-q7vx
Improper random number generation in github.com/coredns/coredns
GHSA-gv9j-4w24-q7vx is a vulnerability with no CVSS score yet in github.com/coredns/coredns, published March 1, 2022. No source lists public exploit code. Fixed in github.com/coredns/coredns 1.6.6.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.6.6github.com/coredns/coredns
Description
Impact
CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.
Patches
The problem has been fixed in 1.6.6+.
References
For more information
Please consult our security guide for more information regarding our security process.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/coredns/corednsGo | before 1.6.6 | 1.6.6 |
What each source reports
GitHub AdvisoriesNo score
Improper random number generation in github.com/coredns/coredns
Impact
CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.
Patches
The problem has been fixed in 1.6.6+.
References
For more information
Please consult our security guide for more information regarding our security process.
- Record
GHSA-gv9j-4w24-q7vx- Weakness
- CWE-330
- Updated
- 2026-11-02
OSVNo score
Improper random number generation in github.com/coredns/coredns
Impact
CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.
Patches
The problem has been fixed in 1.6.6+.
References
For more information
Please consult our security guide for more information regarding our security process.
- Record
GHSA-gv9j-4w24-q7vx- Weakness
- CWE-330
- Updated
- 2026-11-02
OSVGO-2022-0368No score
Improper random number generation in github.com/coredns/coredns
Improper random number generation in github.com/coredns/coredns
- Record
GO-2022-0368- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.