Remote Data Source Vulnerability in Data::Entropy by Perl

CVE-2026-18536

What is CVE-2026-18536?

The Data::Entropy library in Perl is susceptible to a serious vulnerability in versions prior to 0.010, which allows attackers to compromise the integrity of entropy sources accessed over unencrypted HTTP. Specifically, the Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo are accessible in such a manner that makes them vulnerable to manipulation by on-path attackers. These attackers can exploit open WiFi networks, compromised Internet Service Providers (ISPs), or hostile proxies to intercept and alter the responses from these sources. As a result, applications utilizing these entropy sources via the with_entropy_source method may receive manipulated values from rand_bits and rand_int functions, fundamentally undermining security protocols that rely on unpredictable random data.

References