EUVD-2026-51803Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
On-path network positioning is required for exploitation, warranting AC:H; no authentication or user interaction needed; only confidentiality is impacted.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP.
The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP.
The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string.
Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.
AnalysisAI
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully control the random bytes returned by rand_bits and rand_int for every application that selects the RandomOrg or RandomnumbersInfo remote sources via with_entropy_source. The library fetches entropy over plain HTTP with no transport security, and Data::Entropy::RawSource::RandomOrg's integrity check trivially accepts any non-empty byte string, so substituted attacker-controlled responses are never rejected. A vendor-released patch is confirmed at version 0.010; no active exploitation is confirmed (EPSS 0.10%, 1st percentile, not in CISA KEV), but the deterministic nature of the flaw means any secret derived from these sources is entirely known to the attacker.
Technical ContextAI
Data::Entropy is a Perl CPAN library (CPE: cpe:2.3:a:rrwo:data::entropy:*:*:*:*:*:*:*:*) that provides a pluggable entropy/randomness framework. The two remote source backends - Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo - issue HTTP GET requests to third-party true-random number APIs over unencrypted HTTP. The root cause is CWE-319 (Cleartext Transmission of Sensitive Information): because the channel is unencrypted, any on-path observer can both read and modify the entropy payload before it reaches the application. Compounding the issue, the _checkbuf integrity verification method in the RandomOrg source accepts any non-empty byte string as valid, rendering the check entirely ineffective against a substitution attack. The retry and sleep backoff behaviour is also controlled by the same attacker-controlled response, giving an attacker additional control over timing and denial-of-service-adjacent behaviour.
RemediationAI
Upgrade Data::Entropy to version 0.010 or later via CPAN ('cpan install Data::Entropy' or 'cpanm Data::Entropy'); the release changelog is confirmed at https://metacpan.org/release/RRWO/Data-Entropy-0.010/changes and the security advisory at https://github.com/robrwo/Data-Entropy/security/advisories/GHSA-845w-rcqw-jwvv. If an immediate upgrade is not possible, the most effective compensating control is to stop using the affected remote entropy sources entirely and switch to a local entropy source (e.g., Crypt::Random or File::ReadBackwards against /dev/urandom), which eliminates the network attack surface entirely; the trade-off is losing access to hardware true-random number generation from third-party services. Alternatively, if remote entropy is operationally required, use a local TLS-terminating proxy to the upstream APIs and verify certificates, though this introduces operational complexity. Guidance on secure random data selection for Perl is available at https://security.metacpan.org/docs/guides/random-data-for-security.html.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today