High 7.5Published Aug 1, 2026

CVE-2026-18536Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP

Updated under an hour ago (Oct 27, 2026, 3:40 AM ET)

Does this affect you?

It affects RRWO Data::Entropy and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for RRWO Data::Entropy

Exploited in the last 30 days

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string. Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.

CVSS: 7.5 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-319, CWE-353
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: CPANSec
NVD analysis: Analyzed
Record last updated: Aug 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

RRWO Data::Entropy rrwo:data_entropy (from the name)	before 0.010	CNA record
rrwo data::entropy rrwo:data::entropy	before 0.010	NVD

References

References

https://github.com/robrwo/Data-Entropy/security/advisories/GHSA-845w-rcqw-jwvv	vendor-advisory
https://metacpan.org/release/RRWO/Data-Entropy-0.010/changes	release-notes
https://metacpan.org/release/RRWO/Data-Entropy-0.008/view/lib/Data/Entropy.pm#STATUS	release-notes
https://security.metacpan.org/docs/guides/random-data-for-security.html	technical-description, third-party-advisory
http://www.openwall.com/lists/oss-security/2026/08/01/8	mailing-list, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.