{"id":"GHSA-gv9j-4w24-q7vx","aliases":["GO-2022-0368"],"status":"published","title":"Improper random number generation in github.com/coredns/coredns","description":"### Impact\n\nCoreDNS before 1.6.6 (using go DNS package \u003c 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.\n\n### Patches\nThe problem has been fixed in 1.6.6+.\n\n### References\n- [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)\n\n### For more information\nPlease consult [our security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-330"],"published":"2022-03-01T21:03:11Z","modified":"2026-09-10T03:49:28Z","fixes":[{"ecosystem":"Go","package":"github.com/coredns/coredns","fixed_in":["1.6.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/coredns/coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coredns/coredns","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coredns/coredns","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.6"}]}]}],"references":[{"url":"https://github.com/coredns/coredns/security/advisories/GHSA-gv9j-4w24-q7vx","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gv9j-4w24-q7vx"},{"url":"github.com/coredns/coredns","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-gv9j-4w24-q7vx","title":"Improper random number generation in github.com/coredns/coredns","description":"### Impact\n\nCoreDNS before 1.6.6 (using go DNS package \u003c 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.\n\n### Patches\nThe problem has been fixed in 1.6.6+.\n\n### References\n- [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)\n\n### For more information\nPlease consult [our security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.\n","status":"published","published":"2022-03-01T21:03:11Z","modified":"2023-01-11T05:05:23Z","cwes":["CWE-330"],"updated_at":"2026-11-02T14:36:12.361159Z"}],"osv":[{"id":"GHSA-gv9j-4w24-q7vx","title":"Improper random number generation in github.com/coredns/coredns","description":"### Impact\n\nCoreDNS before 1.6.6 (using go DNS package \u003c 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.\n\n### Patches\nThe problem has been fixed in 1.6.6+.\n\n### References\n- [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)\n\n### For more information\nPlease consult [our security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.\n","status":"published","published":"2022-03-01T21:03:11Z","modified":"2026-09-10T03:49:28.357767162Z","cwes":["CWE-330"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"GO-2022-0368","title":"Improper random number generation in github.com/coredns/coredns","description":"Improper random number generation in github.com/coredns/coredns","status":"published","published":"2024-08-21T14:30:31Z","modified":"2026-02-04T04:17:25.74952Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}