GHSA-r5c5-pr8j-pfp7 CVE-2019-11840 GO-2022-0209

golang.org/x/crypto/salsa20/salsa uses insufficiently random values

Medium Go

Severity: 5.9 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 3.45%; Chance of exploitation in the next 30 days. Higher than 89.02% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-330 Use of Insufficiently Random Values
Fix: 0.0.0-20190320223903-b7391e95e576; Upgrade golang.org/x/crypto to this version or later

Description

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

Specific Go Packages Affected

golang.org/x/crypto/salsa20/salsa

Affected versions

Go

Package	Vulnerable	Fixed in
golang.org/x/crypto	`< 0.0.0-20190320223903-b7391e95e576`	`0.0.0-20190320223903-b7391e95e576`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

golang.org/x/crypto Go → `0.0.0-20190320223903-b7391e95e576`

go

go get golang.org/x/crypto@v0.0.0-20190320223903-b7391e95e576 && go mod tidy

Severity breakdown

CVSS 3.1 5.9

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Weakness

CWE-330: Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

How to prevent it

Architecture and Design: Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.
Implementation: Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
Architecture and Design, Requirements: Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2019-11840

Packages

github.com/golang/go

Timeline

May 24, 2022 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GO-2026-6355 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh	High	Also affects golang.org/x/crypto
GO-2026-6354 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh	High	Also affects golang.org/x/crypto
GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh	High	Also affects golang.org/x/crypto
GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	Not rated yet	Also affects golang.org/x/crypto
GHSA-x527-x647-q7gg golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement	Critical	Also affects golang.org/x/crypto
GHSA-w879-237q-wc7r golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS	High	Also affects golang.org/x/crypto
GHSA-vgwf-h737-ff37 golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses	Critical	Also affects golang.org/x/crypto
GHSA-rm3j-f69w-wqmq golang.org/x/crypto vulnerable to infinite loop on large channel writes	Critical	Also affects golang.org/x/crypto

Credits: Michael McLoughlin

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor