Low
Security advisory
Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-11808
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:35 UTC · Revision 1
Source evidence
Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.
osv:CVE-2019-11808
Complete source record
{
"id": "2a4ee26e47f8ee50c5d44b59000048ed2c79a4af00e16219d6c25cc5859b1e89",
"url": "https://osv.dev/vulnerability/CVE-2019-11808",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-11808",
"summary": "Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.",
"evidence": "osv:CVE-2019-11808",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2019-11808",
"aliases": [
"CVE-2019-11808",
"GHSA-54mg-vgrp-mwx9"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ratpack/ratpack",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "11b87db977532b57298c223e4ec82854071b6c20"
},
{
"fixed": "f2b63eb82dd71194319fd3945f5edf29b8f3a42d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ratpack_project:ratpack:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.6.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "f2b63eb82dd71194319fd3945f5edf29b8f3a42d"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "11b87db977532b57298c223e4ec82854071b6c20"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.6.1"
}
]
}
}
],
"versions": [
"v1.6.0",
"v1.6.0-rc-4",
"v1.6.0-rc-3",
"v1.6.0-rc-2",
"1.6.0-rc-1",
"v1.5.0",
"v1.5.0-rc-3",
"v1.5.0-rc-1",
"v1.4.0",
"v1.4.0-rc-3",
"v1.4.0-rc-2",
"v1.4.0-rc-1",
"v1.3.1",
"v1.3.0",
"v1.3.0-rc-2",
"v1.3.0-rc-1",
"v1.2.0",
"v1.2.0-rc-2",
"v1.2.0-RC-1",
"v1.1.1",
"v1.1.0",
"v1.0.0",
"v1.0.0-rc-3",
"v1.0.0-rc-2",
"v1.0.0-rc-1",
"v0.9.19",
"v0.9.18",
"v0.9.17",
"v0.9.16",
"v0.9.15",
"v0.9.14",
"v0.9.13",
"v0.9.12",
"v0.9.11",
"v0.9.10",
"v0.9.9",
"v0.9.8",
"v0.9.7",
"v0.9.6",
"v0.9.5",
"v0.9.4",
"v0.9.3",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"0.6.1",
"0.5.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11808.json",
"vanir_signatures": [
{
"id": "CVE-2019-11808-078847f3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"71367211667805614474262679484365507025",
"154913202557657715797989884372491816929",
"203145417490335592114016916057217824295",
"77552764402514804693061393479611006934"
]
},
"source": "https://github.com/ratpack/ratpack/commit/f2b63eb82dd71194319fd3945f5edf29b8f3a42d",
"target": {
"file": "ratpack-session/src/main/java/ratpack/session/SessionModule.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-11808-0fc3d6e1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"223769642921180714213624975815823092972",
"270234634705521122023414332419619368198",
"192011128202987122063634888260665579081",
"117400372187328187914271744312200082874",
"99069651121528590450252327565252769957",
"305049644449210423698307830915945668901",
"196581739354092496730175082181381076825",
"244116176367642181748269931645136646689",
"300381473656706452809181982359708873149"
]
},
"source": "https://github.com/ratpack/ratpack/commit/f2b63eb82dd71194319fd3945f5edf29b8f3a42d",
"target": {
"file": "ratpack-session/src/main/java/ratpack/session/internal/DefaultSessionIdGenerator.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-11808-4ea60d16",
"digest": {
"length": 174,
"function_hash": "207315375411098578483848171294891764207"
},
"source": "https://github.com/ratpack/ratpack/commit/f2b63eb82dd71194319fd3945f5edf29b8f3a42d",
"target": {
"file": "ratpack-session/src/main/java/ratpack/session/internal/DefaultSessionIdGenerator.java",
"function": "generateSessionId"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:55:53Z"
}
}
],
"modified": "2026-10-20T13:55:53.188908229Z",
"provider": "osv",
"references": [
"https://github.com/ratpack/ratpack/releases/tag/v1.6.1",
"https://github.com/ratpack/ratpack/commit/f2b63eb82dd71194319fd3945f5edf29b8f3a42d",
"https://github.com/ratpack/ratpack/issues/1448"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-11808",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388390,
"published_at": "2019-05-07T07:29:05.167+00:00"
}