CVE-2026-18536: Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP.
The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP.
The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string.
Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by randbits and randint for every application that selected one of these sources via withentropysource. The checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Data::Entropyto a version that resolves this vulnerability.Fixed in 0.010 - Upgrade
Upgrade
Data::Entropy::RawSource::RandomOrgto a version that resolves this vulnerability.Fixed in 0.010 - Upgrade
Upgrade
Data::Entropy::RawSource::RandomnumbersInfoto a version that resolves this vulnerability.Fixed in 0.010 - Configuration
Ensure the Data::Entropy::RawSource::RandomOrg remote entropy source is accessed over HTTPS instead of plain HTTP.
Data::Entropy::RawSource::RandomOrg HTTP vs HTTPS = HTTPS only - Configuration
Ensure the Data::Entropy::RawSource::RandomnumbersInfo remote entropy source is accessed over HTTPS instead of plain HTTP.
Data::Entropy::RawSource::RandomnumbersInfo HTTP vs HTTPS = HTTPS only - Compensating control
Avoid using untrusted on-path sources for entropy. Ensure with_entropy_source does not select remote entropy sources that are reachable via open WiFi, compromised ISP paths, captive portals, or hostile egress proxies (substitute responses can choose the returned rand_bits/rand_int bytes).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18536?
The severity of CVE-2026-18536 is rated at 62.
How do I fix CVE-2026-18536?
To fix CVE-2026-18536, update Data::Entropy to version 0.010 or later.
What versions are affected by CVE-2026-18536?
CVE-2026-18536 affects all versions of Data::Entropy prior to 0.010.
What kind of data does CVE-2026-18536 expose?
CVE-2026-18536 exposes remote entropy sources accessed over plain HTTP.
Who is impacted by CVE-2026-18536?
Users of Data::Entropy for Perl prior to version 0.010 are impacted by CVE-2026-18536.