PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-11840 Debian CVE debrief

CVE-2019-11840 affects the amd64 implementation of golang.org/x/crypto's salsa20 code. After very large keystream generation, the implementation can begin producing incorrect output and then cycle back to previously generated keystream, which can undermine confidentiality in encryption use cases and predictability in CSPRNG use cases. The issue was publicly disclosed in 2019 and is fixed in the upstream crypto repository commit referenced by the official records.

Vendor
Debian
Product
Unknown
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2019-05-09
Original CVE updated
2026-05-18
Advisory published
2019-05-09
Advisory updated
2026-05-18

Who should care

Teams that use golang.org/x/crypto salsa20 on amd64, especially if the code may generate very large amounts of keystream or relies on long-running cryptographic streams. Debian users should also review vendor advisories for affected releases listed in NVD.

Technical summary

NVD describes a flaw in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa before v0.0.0-20190320223903-b7391e95e576. If more than 256 GiB of keystream is generated, or if the counter grows beyond 32 bits, the implementation first produces incorrect output and then reuses earlier keystream. The documented impact is repeated keystream bytes, which can reduce confidentiality in encryption applications or predictability in CSPRNG applications. NVD maps the weakness to CWE-330 and rates the issue CVSS 3.1 5.9 (Medium).

Defensive priority

Medium. The flaw is not listed in the supplied data as actively exploited or in CISA KEV, but it can affect confidentiality where large keystream volumes are possible. Priority should rise for systems using long-lived or high-volume salsa20-based encryption paths.

Recommended defensive actions

  • Confirm whether your applications depend on golang.org/x/crypto salsa20 or salsa on amd64.
  • Upgrade to a version at or after the fixed upstream reference identified in the record (v0.0.0-20190320223903-b7391e95e576 or newer).
  • Review any long-running encryption or CSPRNG uses that might approach very large keystream generation.
  • Check distro/vendor advisories for packaged copies, including the Debian LTS announcements referenced by NVD.
  • If replacement is not immediate, limit reliance on affected implementations for high-volume stream generation and prioritize patching.

Evidence notes

The core vulnerability statement comes from the NVD record and the CVE description, which note incorrect output and keystream cycling in the amd64 implementation after more than 256 GiB of output or a counter beyond 32 bits. Supporting references include the upstream Go issue, the upstream patch commit, and Debian LTS advisories. The supplied data does not indicate CISA KEV inclusion or ransomware linkage.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-11840 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-11840

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-11840 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-11840

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.