CVE-2026-18536
Received Received - Intake

Information Disclosure in Data::Entropy Perl Module

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: CPANSec

Description
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string. Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-18536
EUVD
EUVD-2026-51803

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-353 The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Perl module Data::Entropy before version 0.010. It allows remote entropy sources to be read over plain HTTP, which is insecure. Two specific sources, RandomOrg and RandomnumbersInfo, are accessed without encryption. An attacker on the network path can intercept and replace the responses, manipulating random number generation in applications using these sources.

Detection Guidance

Check Perl applications using Data::Entropy versions before 0.010. Inspect network traffic for plain HTTP requests to entropy sources like RandomOrg or RandomnumbersInfo. Use packet capture tools like tcpdump or Wireshark to monitor outbound connections to these domains.

Impact Analysis

If you use Data::Entropy with the vulnerable sources, an attacker could control the random numbers generated by your application. This could lead to security failures like broken cryptographic operations, predictable session tokens, or compromised authentication mechanisms. The attacker only needs to be on your network path, such as on open WiFi or through a compromised ISP.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling attackers to manipulate random number generation used in cryptographic operations. If entropy sources are compromised, it may weaken encryption, potentially violating data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Data::Entropy to version 0.010 or later. Replace plain HTTP entropy sources with HTTPS alternatives. Disable insecure entropy sources if HTTPS is unavailable. Review and update firewall rules to block unencrypted traffic to these domains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18536. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart