{"id":"CVE-2019-11289","aliases":["EUVD-2021-0951","GHSA-5796-p3m6-9qj4","GO-2021-0102"],"status":"published","title":"A forged route service request using an invalid nonce can cause the gorouter to panic and crash","description":"Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.","severity":{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0151,"percentile":0.74625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2019-11-19T18:41:04Z","modified":"2026-10-24T10:30:48Z","fixes":[{"ecosystem":"Go","package":"code.cloudfoundry.org/gorouter","fixed_in":["0.0.0-20191101214924-b1b5c44e050f"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/cloudfoundry/gorouter","fixed_in":["0.0.0-20191101214924-b1b5c44e050f"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"code.cloudfoundry.org/gorouter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20191101214924-b1b5c44e050f"}]}]},{"source":"osv","ecosystem":"Go","package":"code.cloudfoundry.org/gorouter","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20191101214924-b1b5c44e050f"}]}]},{"source":"osv","ecosystem":"Go","package":"code.cloudfoundry.org/gorouter","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20191101214924-b1b5c44e050f"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cloudfoundry/gorouter","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20191101214924-b1b5c44e050f"}]}]}],"products":[{"vendor":"cloud foundry","product":"routing"},{"vendor":"cloudfoundry","product":"cf-deployment"},{"vendor":"cloudfoundry","product":"routing-release"}],"references":[{"url":"https://www.cloudfoundry.org/blog/cve-2019-11289","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11289","tags":["advisory"]},{"url":"https://github.com/cloudfoundry/gorouter/commit/b1b5c44e050f73b399b379ca63a42a2c5780a83f","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0102","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5796-p3m6-9qj4"},{"url":"https://github.com/cloudfoundry/gorouter","tags":["package"]},{"url":"https://www.cloudfoundry.org/blog/cve-2019-11289/","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-11289","title":"A forged route service request using an invalid nonce can cause the gorouter to panic and crash","description":"Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.","status":"published","published":"2019-11-19T18:41:04.566Z","modified":"2024-09-16T22:14:00.61Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:20:26.416173Z"}],"euvd":[{"id":"EUVD-2021-0951","description":"Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.","status":"published","published":"2019-11-19T18:41:04Z","modified":"2024-09-16T22:14:00Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:05.279117Z"}],"ghsa":[{"id":"GHSA-5796-p3m6-9qj4","title":"Cloud Foundry Routing Improper Input Validation vulnerability","description":"Cloud Foundry Routing, all versions before 0.0.0-20191101214924-b1b5c44e050f, does not properly validate nonce input. A remote unauthorized malicious user could forge a route service request using an invalid nonce that will cause the Gorouter to crash.","status":"published","published":"2021-05-18T15:31:39Z","modified":"2024-05-20T19:56:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2019-11289","description":"Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.","status":"published","published":"2019-11-19T19:15:23.673Z","modified":"2026-06-17T02:12:41.017Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:05:37.024431Z"}],"osv":[{"id":"CVE-2019-11289","description":"Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.","status":"published","published":"2019-11-19T19:15:23.673Z","modified":"2026-10-24T10:30:48.900434951Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-5796-p3m6-9qj4","title":"Cloud Foundry Routing Improper Input Validation vulnerability","description":"Cloud Foundry Routing, all versions before 0.0.0-20191101214924-b1b5c44e050f, does not properly validate nonce input. A remote unauthorized malicious user could forge a route service request using an invalid nonce that will cause the Gorouter to crash.","status":"published","published":"2021-05-18T15:31:39Z","modified":"2024-05-20T19:56:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"GO-2021-0102","title":"Panic in decryption in code.cloudfoundry.org/gorouter","description":"Due to improper input validation, a maliciously crafted input can cause a panic, due to incorrect nonce size. If this package is used to decrypt user supplied messages without checking the size of supplied nonces, this may be used as a vector for a denial of service attack.","status":"published","published":"2021-07-28T18:08:05Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}