CVE-2026-18536 Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP
An on-path attacker can manipulate entropy sources in Data::Entropy, compromising randomness for applications using this Perl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18536?
CVE-2026-18536 is a high-severity vulnerability in RRWO Data::Entropy, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP.
The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP.
The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string.
Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.
Which versions are affected by CVE-2026-18536?
It affects 1 product.
Products include Rrwo Data\.
How do I fix CVE-2026-18536?
No fix has been published for CVE-2026-18536 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-18536 being exploited?
There is no known exploitation of CVE-2026-18536 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-18536, GHSA-845w-rcqw-jwvv, UBUNTU-CVE-2026-18536.