Description
The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.
References (5)
Scores
CVSS v3
5.9
EPSS
0.0030
EPSS Percentile
53.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-338
Status
published
Products (2)
miekg/dns
0 - 1.1.25Go
miekg-dns_project/miekg-dns
< 1.1.25
Published
Dec 13, 2019
Tracked Since
Feb 18, 2026