CVE-2026-18536

Name of the Vulnerable Software and Affected Versions Data::Entropy versions prior to 0.010

Description Remote entropy sources are accessed over plain HTTP, which allows an on-path attacker to substitute the response. This enables the attacker to control the bytes returned by the rand bits and rand int functions for applications using with entropy source to select the Data::Entropy::RawSource::RandomOrg or Data::Entropy::RawSource::RandomnumbersInfo sources. Additionally, the integrity check in Data::Entropy::RawSource::RandomOrg matches any non-empty byte string, and the response for the checkbuf() method is attacker-controlled, allowing the manipulation of retry and sleep behaviors.

Recommendations Update Data::Entropy to version 0.010 or later.