PT-2026-67133 · Cpan · Data::Entropy

CVE-2026-18536 · Published 2026-08-01 · Updated 2026-08-01

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Data::Entropy versions prior to 0.010

Description Remote entropy sources are accessed over plain HTTP, which allows an on-path attacker to substitute the response. This enables the attacker to control the bytes returned by the rand bits and rand int functions for applications using with entropy source to select the Data::Entropy::RawSource::RandomOrg or Data::Entropy::RawSource::RandomnumbersInfo sources. Additionally, the integrity check in Data::Entropy::RawSource::RandomOrg matches any non-empty byte string, and the response for the checkbuf() method is attacker-controlled, allowing the manipulation of retry and sleep behaviors.

Recommendations Update Data::Entropy to version 0.010 or later.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

CWE-353

Related Identifiers

CVE-2026-18536

GHSA-845W-RCQW-JWVV

Affected Products

Data::Entropy

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18536.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-18536 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-18536 · Security Note
• https://github.com/robrwo/Data-Entropy/security/advisories/GHSA-845w-rcqw-jwvv · Vendor Advisory
• https://metacpan.org/release/RRWO/Data-Entropy-0.010/changes · Note
• https://github.com/robrwo/Data-Entropy · Note
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note
• https://metacpan.org/release/RRWO/Data-Entropy-0.008/view/lib/Data/Entropy.pm#STATUS · Note
• http://openwall.com/lists/oss-security/2026/08/01/8 · Note
• https://cpan.org/modules · Note