Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/flynn/noise
  4. ›
  5. CVE-2021-4239

CVE-2021-4239: Noise vulnerable to uncontrolled resource consumption

December 28, 2022 (updated December 29, 2022)

The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 (~18.4 quintillion) messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce. In a separate issue, the Decrypt function increments the nonce state even when it fails to decrypt a message. If an attacker can provide an invalid input to the Decrypt function, this will cause the nonce state to desynchronize between the peers, resulting in a failure to encrypt all subsequent messages.

References

  • github.com/advisories/GHSA-6cr6-fmvc-vw2p
  • github.com/flynn/noise/commit/2499bf1bad239a8316c32932a993642350b3afdb
  • github.com/flynn/noise/pull/44
  • nvd.nist.gov/vuln/detail/CVE-2021-4239
  • pkg.go.dev/vuln/GO-2022-0425

Code Behaviors & Features

Detect and mitigate CVE-2021-4239 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 1.0.0

Fixed versions

  • v1.0.0

Solution

Upgrade to version 1.0.0 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Learn more about CVSS

Source file

go/github.com/flynn/noise/CVE-2021-4239.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:24 +0000.