{"id":"CVE-2019-11808","aliases":["GHSA-54mg-vgrp-mwx9"],"url":"https://o3.security/vulnerability/CVE-2019-11808","summary":"Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack","details":"Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.","published":"2019-05-07T07:29:05.167Z","modified":"2026-07-08T15:55:06.570460Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.ratpack:ratpack-session","fixedVersion":"1.6.1"},{"ecosystem":"Maven","name":"io.ratpack:ratpack-java","fixedVersion":"1.6.1"},{"ecosystem":"Maven","name":"io.ratpack:ratpack-groovy","fixedVersion":"1.6.1"}],"fix":{"url":"https://github.com/ratpack/ratpack/commit/f2b63eb82dd71194319fd3945f5edf29b8f3a42d","label":"ratpack/ratpack@f2b63eb"},"references":[{"type":"ADVISORY","url":"https://github.com/ratpack/ratpack/releases/tag/v1.6.1"},{"type":"FIX","url":"https://github.com/ratpack/ratpack/commit/f2b63eb82dd71194319fd3945f5edf29b8f3a42d"},{"type":"FIX","url":"https://github.com/ratpack/ratpack/issues/1448"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T15:55:06.570460Z"}}