Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2019-25005: Rust ChaCha20 Counter Overflow Exposes Sensitive Data
CVE-2019-25005 · published 5 years ago
Summary
A bug in the ChaCha20 encryption library used in some Rust applications can allow attackers to guess sensitive information. This affects applications that use the chacha20 crate before version 0.2.3. To fix this, update the chacha20 crate to the latest version.
What to do
- Update newpavlov chacha20 to version 0.2.3.
- Update chacha20_project chacha20 to version 0.2.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | newpavlov | chacha20 |
< 0.2.3 Fix: upgrade to 0.2.3
|
| – | chacha20_project | chacha20 |
< 0.2.3 cpe:2.3:a:chacha20_project:chacha20:*:*:*:*:*:rust:*:* |
Original advisory text
An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.
An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-190Integer Overflow
Timeline
Published31 Dec 2020
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta