What’s Vulnerable › Vulnerabilities

CVE-2016-15005: Cryptographically weak random number generation in github.com/dinever/golf

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-27 · updated 2026-06-17
• Weakness: CWE-352

Description

CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.

Affected products

• github.com/dinever/golf: before 0.3.0 — fixed in 0.3.0

How to fix

Upgrade to a fixed version: github.com/dinever/golf 0.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/dinever/golf/commit/3776f338be48b5bc5e8cf9faff7851fc52a3f1fe
• https://github.com/dinever/golf/issues/20
• https://github.com/dinever/golf/pull/24
• https://pkg.go.dev/vuln/GO-2020-0045
• https://github.com/dinever/golf/commit/3776f338be48b5bc5e8cf9faff7851fc52a3f1fe
• https://github.com/dinever/golf/issues/20
• https://github.com/dinever/golf/pull/24
• https://pkg.go.dev/vuln/GO-2020-0045

Get alerted when CVE-2016-15005 or the next vulnerability affects your stack