Data::Entropy CVE-2026-18536

The application must explicitly configure Data::Entropy::RawSource::RandomOrg or Data::Entropy::RawSource::RandomnumbersInfo as its entropy source using with_entropy_source - this is not a default configuration and represents a deliberate opt-in. The attacker must be on-path between the application host and the upstream HTTP entropy endpoint (random.org or randomnumbers.info), achievable via open WiFi control, ISP-level interception, captive portal injection, or a hostile egress proxy. Exploitation is limited by the non-default nature of the remote sources and the attacker's need for network positioning; applications using local entropy providers (the typical pattern) are entirely unaffected regardless of version.

The NVD CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is likely overgenerous on AC: achieving an on-path position (open WiFi intercept, ISP compromise, captive portal injection, hostile egress proxy) is a real prerequisite that is not universally achievable, which would support AC:H rather than AC:L, reducing the score to approximately 5.9 (Medium). The confidentiality impact of H is well justified because controlling entropy is equivalent to knowing all cryptographic material derived from it - session tokens, keys, nonces. EPSS is very low at 0.10% (1st percentile), consistent with this being a niche Perl CPAN module with limited deployment and no public exploit code. The flaw is not in CISA KEV, and no POC has been published. Real-world risk is heavily gated on whether an application explicitly opts into one of the two affected remote sources via with_entropy_source - applications using local entropy (the typical and default pattern) are entirely unaffected. For those that do use the remote sources, however, the impact is total loss of randomness confidentiality.

An attacker positioned on the network path between the vulnerable Perl application and random.org - for example, operating a rogue open WiFi access point or compromising an egress proxy - intercepts the unencrypted HTTP entropy request and responds with a predetermined byte sequence of their choice. Because the integrity check accepts any non-empty string, the crafted response passes validation and is consumed by with_entropy_source, making every subsequent call to rand_bits and rand_int return attacker-controlled values; any cryptographic key, session token, or nonce derived from these values is therefore fully predictable to the attacker. No public exploit code has been identified at time of analysis.