CVE-2019-11289: Panic in decryption in code.cloudfoundry.org/gorouter
Summary
CVE-2019-11289: Panic in decryption in code.cloudfoundry.org/gorouter. Affects code.cloudfoundry.org/gorouter versions < 0.0.0-20191101214924-b1b5c44e050f. Fixed in 0.0.0-20191101214924-b1b5c44e050f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The code.cloudfoundry.org/gorouter package is a component of the Cloud Foundry platform that acts as a router for incoming network traffic. It is responsible for directing requests to the appropriate backend applications. The package utilizes the AesGCM.Decrypt function from the code.cloudfoundry.org/gorouter/common/secure module for decrypting user-supplied messages. This vulnerability affects versions 0.0.0-20191101214924-b1b5c44e050f and earlier.
Vulnerability Detail
The vulnerability arises from improper input validation in the decryption process. An attacker can exploit this by providing a maliciously crafted input with an incorrect nonce size. If the package is used to decrypt user-supplied messages without verifying the size of the nonces, it can lead to a panic, resulting in a denial of service (DoS) attack. This vulnerability can potentially disrupt the normal operation of the code.cloudfoundry.org/gorouter package.
How To Fix
Latest published version: v0.0.0-20250429140807-a602bb6a6243 as of 23 Oct 2026
go get code.cloudfoundry.org/gorouter@v0.0.0-20250429140807-a602bb6a6243Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20191101214924-b1b5c44e050f
This is the first release that contains the fix.
go get code.cloudfoundry.org/gorouter@v0.0.0-20191101214924-b1b5c44e050fTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can consider implementing additional input validation checks for nonces in their application code to mitigate the risk of exploitation.
Conclusion
The code.cloudfoundry.org/gorouter package is vulnerable to a panic in decryption due to improper input validation. This can be exploited to launch a denial of service (DoS) attack. It is crucial to update the package to the fixed version and implement proper input validation checks to ensure the security and stability of applications utilizing this package. For additional support, please contact DevNack.com.
See every vulnerability recorded for code.cloudfoundry.org/gorouter →
FAQ
This vulnerability can be exploited by an attacker to cause a panic in the decryption process, leading to a denial of service (DoS) attack. It can disrupt the normal operation of the code.cloudfoundry.org/gorouter package and potentially affect the availability of the application.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities, including this one, are found.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to apply the recommended fix to prevent potential exploitation.
While updating the package to the fixed version is the recommended approach, you can also consider implementing additional input validation checks for nonces in your application code. This can help mitigate the risk of exploitation, but it is still advisable to update the package to ensure comprehensive security.
For further support and assistance with vulnerability remediation, you can reach out to info@devnack.com. Our team of experts will be happy to help you address any concerns or questions you may have.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
