CVE-2019-19794: Insecure generation of random numbers in github.com/miekg/dns
Summary
CVE-2019-19794: Insecure generation of random numbers in github.com/miekg/dns. Affects github.com/miekg/dns versions < 1.1.25-0.20191211073109-8ebf2e419df7. Fixed in 1.1.25-0.20191211073109-8ebf2e419df7. How to fix ↓
Also tracked for
- golang-github-miekg-dns · Debian:11
The same CVE-2019-19794 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/miekg/dns package is a Go library that provides DNS message handling functionality. It allows developers to create, parse, and manipulate DNS messages. The package is widely used in various Go applications for DNS-related tasks.
Vulnerability Detail
The vulnerability (CVE-2019-19794) in github.com/miekg/dns arises from the insecure generation of random numbers for DNS message transaction IDs. The package uses the math/rand library, which makes the transaction IDs relatively predictable. This weakness reduces the complexity of response spoofing attacks against DNS clients. An attacker could potentially exploit this vulnerability to manipulate DNS responses and deceive DNS clients.
How To Fix
Latest published version: v1.1.73 as of 23 Oct 2026
go get github.com/miekg/dns@v1.1.73Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.25-0.20191211073109-8ebf2e419df7
This is the first release that contains the fix.
go get github.com/miekg/dns@v1.1.25-0.20191211073109-8ebf2e419df7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually implement a secure random number generator using the crypto/rand library and replace the insecure random number generation in the affected code. Here's an example of how to generate a secure random number in Go:
import (
"crypto/rand"
"math/big"
)
func generateRandomNumber() (int, error) {
randomNumber, err := rand.Int(rand.Reader, big.NewInt(65536))
if err != nil {
return 0, err
}
return int(randomNumber.Int64()), nil
}
Conclusion
In summary, the github.com/miekg/dns package is vulnerable to an insecure generation of random numbers for DNS message transaction IDs. This vulnerability reduces the complexity of response spoofing attacks against DNS clients. To mitigate the risk, developers should update their applications to use a secure random number generator, such as the one provided by the crypto/rand library in Go. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/miekg/dns →
FAQ
This vulnerability reduces the complexity of response spoofing attacks against DNS clients. An attacker could potentially manipulate DNS responses and deceive DNS clients.
Versions 0.0.1 through 1.1.24 of github.com/miekg/dns are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, a fix is available for this vulnerability. Developers should update their applications to use a secure random number generator, such as the one provided by the crypto/rand library in Go.
You can find more information about this vulnerability, including its technical details and affected versions, in the vulnerability database entry at https://pkg.go.dev/vuln/GO-2020-0008.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/miekg/dns.
