CVE-2019-11840 in Google
Summary
by MITRE
An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa packages. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/18/2026
The vulnerability identified as CVE-2019-11840 represents a critical flaw in the Go programming language's cryptographic libraries, specifically affecting the amd64 implementation of the salsa20 stream cipher. This issue resides within the golang-googlecode-go-crypto package, which is part of the broader Go ecosystem used extensively for building secure applications. The flaw manifests in the implementation of two specific cryptographic functions: golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa, both of which are widely utilized in encryption and random number generation applications. The vulnerability is particularly concerning because it affects the fundamental security properties of these cryptographic primitives, which are critical building blocks for secure communications and data protection.
The technical nature of this vulnerability stems from an integer overflow condition within the counter mechanism of the salsa20 implementation. When the keystream generation exceeds 256 gigabytes or when the counter surpasses the 32-bit limit, the amd64 assembly implementation begins producing incorrect cryptographic output. This flaw occurs because the counter variable, which tracks the position within the keystream, overflows and causes the implementation to cycle back to previously generated keystream values. The mathematical properties of the salsa20 algorithm, which relies on a 64-bit counter and a 32-bit nonce, create a scenario where counter overflow leads to predictable cryptographic behavior. This represents a violation of the fundamental cryptographic principle that keystreams should remain unique and unpredictable throughout their usage, directly impacting the confidentiality and integrity guarantees that users expect from these cryptographic functions.
The operational impact of this vulnerability extends far beyond simple cryptographic weakness, as it can lead to significant security breaches in applications that rely on the affected cryptographic primitives. When repeated keystream bytes are generated, attackers can potentially reconstruct plaintext from encrypted messages, especially in scenarios where the same key is reused for multiple encryptions. The vulnerability particularly affects applications using the salsa20 cipher for encryption, where the reuse of keystream bytes can enable cryptanalytic attacks such as the known-plaintext attack or even complete decryption of the encrypted data. Additionally, in cryptographic applications serving as cryptographically secure pseudorandom number generators, the predictability introduced by the cycling keystream can compromise the security of random number generation, affecting everything from session token generation to key derivation processes. This vulnerability aligns with CWE-128, which describes "Wrap or Overflow" conditions in integer operations, and represents a classic example of how low-level implementation details can create catastrophic security failures.
The remediation approach for this vulnerability requires immediate updates to the affected Go cryptographic libraries, specifically ensuring that all installations are updated to versions released after March 20, 2019, when the fix was implemented. Organizations should conduct thorough inventory checks to identify all systems using the vulnerable golang-googlecode-go-crypto package, particularly those running Go applications that utilize the salsa20 cipher for encryption or random number generation. The fix implemented by the Go team addressed the counter overflow condition by ensuring proper handling of the 32-bit counter overflow, preventing the cycling back to previously generated keystream values. Security teams should also consider implementing monitoring for applications that may be using the affected cryptographic functions, as the vulnerability may not be immediately apparent through normal application behavior. From an ATT&CK framework perspective, this vulnerability maps to techniques involving credential access and defense evasion, as compromised cryptographic implementations can lead to unauthorized access to encrypted data and may be used to evade detection by security monitoring systems that rely on proper cryptographic function behavior. Organizations should also review their cryptographic implementation practices and consider implementing more robust testing procedures for cryptographic libraries to identify similar edge case vulnerabilities in other cryptographic primitives.