robrwo Data::Entropy up to 0.9 _checkbuf integrity check

Summaryinfo

A vulnerability, which was classified as critical, has been found in robrwo Data::Entropy up to 0.9. This affects the function _checkbuf. Performing a manipulation results in integrity check. This vulnerability is cataloged as CVE-2026-18536. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in robrwo Data::Entropy up to 0.9. This affects the function _checkbuf. The manipulation with an unknown input leads to a integrity check vulnerability. CWE is classifying the issue as CWE-354. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string. Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-18536 since 07/31/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.010 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51803). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• robrwo

Name

• Data::Entropy

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion