PT-2026-21579 · Unknown+1 · Data::Random+1

Robert Rothenberg · Published 2026-02-23 · Updated 2026-03-04 · CVE-2024-58041

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Smolder versions through 1.51

Description Smolder for Perl versions through 1.51 utilizes an insecure rand() function for cryptographic operations. Specifically, Smolder::DB::Developer employs the Data::Random library, which relies on the rand() function and is intended primarily for testing purposes, not for secure cryptographic applications. The rand() function is not a cryptographically secure source of entropy.

Recommendations Versions prior to 1.52 should be updated.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2024-58041

Affected Products

Data::Random

Smolder

References · 14

• https://osv.dev/vulnerability/CVE-2024-58041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58041 · Security Note
• https://twitter.com/cracbot/status/2027700421771595930 · Twitter Post
• https://twitter.com/CVEarity/status/2026153848214339917 · Twitter Post
• https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537 · Note
• https://twitter.com/cracbot/status/2027338122263204090 · Twitter Post
• https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L221 · Note
• https://twitter.com/CVEnew/status/2026184667762966553 · Twitter Post
• https://twitter.com/cracbot/status/2028062735481880578 · Twitter Post
• https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L5 · Note
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note
• https://perldoc.perl.org/functions/rand · Note
• https://t.me/cveNotify/152942 · Telegram Post
• https://t.me/cveNotify/154052 · Telegram Post