What is the CVSS score of CVE-2024-58041?

CVE-2024-58041 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Smolder are affected by CVE-2024-58041?

Smolder versions 1.51 and earlier contain a critical cryptographic vulnerability that weakens security token generation and authentication mechanisms.

How to fix or mitigate CVE-2024-58041?

Within 24 hours: Inventory all systems running Smolder and assess whether cryptographic functions are actively used in production. Within 7 days: Evaluate upgrade feasibility to Smolder 1.52 or later if available, or identify alternative Perl cryptographic libraries that use secure entropy sources (e.g., Crypt::Random). Within 30 days: Complete migration away from vulnerable Smolder versions or implement application-level compensating controls and validate effectiveness through security testing.

Smolder CVE-2024-58041

CRITICAL

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-02-24 9b29abf9-4ab0-4765-b253-1875cd9b441e

Information Disclosure Smolder

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 00:16 nvd

CRITICAL 9.1

DescriptionCVE.org

Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions.

Smolder 1.51 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Specifically Smolder::DB::Developer uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.

AnalysisAI

Insecure random number generation in Smolder 1.51 Perl testing framework. Uses rand() for cryptographic operations instead of a CSPRNG, enabling prediction of security tokens.