What’s Vulnerable › Vulnerabilities

CVE-2019-19794: miekg/dns insecurely generates random numbers

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-13 · updated 2026-06-17
• Weakness: CWE-338

Description

The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

Affected products

• Miekg-Dns Project Miekg-Dns: before 1.1.25 — fixed in 1.1.25
• Go Github.Com/Miekg/Dns: before 1.1.25-0.20191211073109-8ebf2e419df7 — fixed in 1.1.25-0.20191211073109-8ebf2e419df7

How to fix

Upgrade to a fixed version: Miekg-Dns Project Miekg-Dns 1.1.25; Go Github.Com/Miekg/Dns 1.1.25-0.20191211073109-8ebf2e419df7. Check the vendor advisory for mitigations.

References

• https://github.com/coredns/coredns/issues/3519
• https://github.com/coredns/coredns/issues/3547
• https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
• https://github.com/miekg/dns/issues/1043
• https://github.com/miekg/dns/pull/1044
• https://github.com/coredns/coredns/issues/3519
• https://github.com/coredns/coredns/issues/3547
• https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
• https://github.com/miekg/dns/issues/1043
• https://github.com/miekg/dns/pull/1044

Get alerted when CVE-2019-19794 or the next vulnerability affects your stack