CWE-338
AllowedUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Abstraction: Base · Status: Draft
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
324 vulnerabilities reference this CWE, most recent first.
GHSA-H236-32WJ-MG7X
Vulnerability from github – Published: 2025-04-05 21:30 – Updated: 2025-04-14 18:31Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
Specifically Net::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
{
"affected": [],
"aliases": [
"CVE-2024-56370"
],
"database_specific": {
"cwe_ids": [
"CWE-331",
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-05T19:15:38Z",
"severity": "MODERATE"
},
"details": "Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nSpecifically Net::Xero uses the Data::Random library which specifically states that it is \"Useful mostly for test programs\". Data::Random uses the rand() function.",
"id": "GHSA-h236-32wj-mg7x",
"modified": "2025-04-14T18:31:48Z",
"published": "2025-04-05T21:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56370"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/ELLIOTT/Net-Xero-0.44/source/lib/Net/Xero.pm#L58"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/ELLIOTT/Net-Xero-0.44/source/lib/Net/Xero.pm#L9"
},
{
"type": "WEB",
"url": "https://perldoc.perl.org/functions/rand"
},
{
"type": "WEB",
"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H295-PFX3-R298
Vulnerability from github – Published: 2026-05-21 00:30 – Updated: 2026-05-21 15:34Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.
These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
{
"affected": [],
"aliases": [
"CVE-2026-47372"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-20T22:16:37Z",
"severity": "CRITICAL"
},
"details": "Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.\n\nThese versions use the built-in rand function, which is predictable and unsuitable for cryptography.",
"id": "GHSA-h295-pfx3-r298",
"modified": "2026-05-21T15:34:06Z",
"published": "2026-05-21T00:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47372"
},
{
"type": "WEB",
"url": "https://github.com/robrwo/perl-Crypt-SaltedHash/commit/9b68437d2cd420b819b3a795474c3870338d38d5.patch"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/RRWO/Crypt-SaltedHash-0.10/changes"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/20/22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H3G4-WMRW-RM63
Vulnerability from github – Published: 2026-06-16 00:34 – Updated: 2026-06-16 18:32Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.
The default nonce was generated using an MD5 hash of the epoch time, which is predictable.
{
"affected": [],
"aliases": [
"CVE-2026-11832"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T22:16:15Z",
"severity": "CRITICAL"
},
"details": "Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.\n\nThe default nonce was generated using an MD5 hash of the epoch time, which is predictable.",
"id": "GHSA-h3g4-wmrw-rm63",
"modified": "2026-06-16T18:32:33Z",
"published": "2026-06-16T00:34:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11832"
},
{
"type": "WEB",
"url": "https://datatracker.ietf.org/doc/html/rfc5849#section-3.3"
},
{
"type": "WEB",
"url": "https://datatracker.ietf.org/doc/html/rfc5849#section-4.9"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/BIAFRA/Dancer2-Plugin-Auth-OAuth-0.22/changes"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22376"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H3X4-G6F9-GP4X
Vulnerability from github – Published: 2026-07-22 21:32 – Updated: 2026-07-27 18:31Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
{
"affected": [],
"aliases": [
"CVE-2026-64798"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-22T21:18:10Z",
"severity": "CRITICAL"
},
"details": "Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.",
"id": "GHSA-h3x4-g6f9-gp4x",
"modified": "2026-07-27T18:31:42Z",
"published": "2026-07-22T21:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64798"
},
{
"type": "WEB",
"url": "https://regularlabs.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H4GQ-Q399-XM7R
Vulnerability from github – Published: 2022-05-14 02:20 – Updated: 2022-05-14 02:20The randMod() function of the smart contract implementation for MyCryptoChamp, an Ethereum game, generates a random value with publicly readable variables such as the current block information and a private variable, (which can be read with a getStorageAt call). Therefore, attackers can get powerful champs/items and get rewards.
{
"affected": [],
"aliases": [
"CVE-2018-12885"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-07T15:29:00Z",
"severity": "MODERATE"
},
"details": "The randMod() function of the smart contract implementation for MyCryptoChamp, an Ethereum game, generates a random value with publicly readable variables such as the current block information and a private variable, (which can be read with a getStorageAt call). Therefore, attackers can get powerful champs/items and get rewards.",
"id": "GHSA-h4gq-q399-xm7r",
"modified": "2022-05-14T02:20:31Z",
"published": "2022-05-14T02:20:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12885"
},
{
"type": "WEB",
"url": "https://etherscan.io/address/0x689FB61845488297dfE7586E5f7956475955d2Dc"
},
{
"type": "WEB",
"url": "https://etherscan.io/address/0xa44e464b13280340904ffef0a65b8a0033460430"
},
{
"type": "WEB",
"url": "https://medium.com/coinmonks/get-legendary-items-by-breaking-pnrg-of-mycyptochamp-an-ethereum-online-game-cve-2018-12855-6e6beb41b8df"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HCM7-VVXH-5CRX
Vulnerability from github – Published: 2024-02-08 21:30 – Updated: 2024-02-15 18:30The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 2023. An attacker can systematically generate mnemonics for each timestamp within an applicable timeframe, and link them to specific wallet addresses in order to steal funds from those wallets.
{
"affected": [],
"aliases": [
"CVE-2024-23660"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-08T20:15:52Z",
"severity": "HIGH"
},
"details": "The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 2023. An attacker can systematically generate mnemonics for each timestamp within an applicable timeframe, and link them to specific wallet addresses in order to steal funds from those wallets.",
"id": "GHSA-hcm7-vvxh-5crx",
"modified": "2024-02-15T18:30:40Z",
"published": "2024-02-08T21:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23660"
},
{
"type": "WEB",
"url": "https://milksad.info/posts/research-update-5"
},
{
"type": "WEB",
"url": "https://secbit.io/blog/en/2024/01/19/trust-wallets-fomo3d-summer-vuln"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HX58-X97G-CC9P
Vulnerability from github – Published: 2022-05-14 03:18 – Updated: 2022-05-14 03:18** DISPUTED ** The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability.
{
"affected": [],
"aliases": [
"CVE-2017-9230"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-24T16:29:00Z",
"severity": "HIGH"
},
"details": "** DISPUTED ** The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability.",
"id": "GHSA-hx58-x97g-cc9p",
"modified": "2022-05-14T03:18:09Z",
"published": "2022-05-14T03:18:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9230"
},
{
"type": "WEB",
"url": "https://arxiv.org/ftp/arxiv/papers/1604/1604.00575.pdf"
},
{
"type": "WEB",
"url": "https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-April/013996.html"
},
{
"type": "WEB",
"url": "https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014349.html"
},
{
"type": "WEB",
"url": "https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014351.html"
},
{
"type": "WEB",
"url": "https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014352.html"
},
{
"type": "WEB",
"url": "http://www.mit.edu/~jlrubin//public/pdfs/Asicboost.pdf"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98657"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HX6M-XFX3-6P5X
Vulnerability from github – Published: 2025-04-07 15:31 – Updated: 2025-04-07 21:32Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
Specifically Net::Dropbox::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
{
"affected": [],
"aliases": [
"CVE-2024-58036"
],
"database_specific": {
"cwe_ids": [
"CWE-331",
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-05T16:15:33Z",
"severity": "MODERATE"
},
"details": "Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nSpecifically Net::Dropbox::API uses the Data::Random library which specifically states that it is \"Useful mostly for test programs\". Data::Random uses the rand() function.",
"id": "GHSA-hx6m-xfx3-6p5x",
"modified": "2025-04-07T21:32:07Z",
"published": "2025-04-07T15:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58036"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L11"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L385"
},
{
"type": "WEB",
"url": "https://perldoc.perl.org/functions/rand"
},
{
"type": "WEB",
"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-HXP2-C3HQ-RCQ5
Vulnerability from github – Published: 2024-05-23 09:30 – Updated: 2024-05-23 09:30Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis
{
"affected": [],
"aliases": [
"CVE-2024-5264"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-23T09:15:10Z",
"severity": "MODERATE"
},
"details": "Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis",
"id": "GHSA-hxp2-c3hq-rcq5",
"modified": "2024-05-23T09:30:29Z",
"published": "2024-05-23T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5264"
},
{
"type": "WEB",
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=50da3cd9c302c218204e2a6ce00131b9\u0026sysparm_article=KB0028531"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J37G-G7HG-VHG6
Vulnerability from github – Published: 2026-07-01 06:31 – Updated: 2026-07-09 06:31UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. In rfb/vncauth.c:119-129, the vncRandomBytes() function seeds libc rand() with time(0) + getpid() + rand() and generates a 16-byte challenge. The combined seed space is approximately 31 bits (libc rand() internal state) and is entirely determined by publicly-observable values (wall-clock time and process ID). An attacker who can observe the authentication exchange can enumerate the seed space and predict the challenge within seconds, enabling forgery or offline brute-forcing of responses. Note: on Windows, the active code path may use vncEncryptBytes2.cpp which calls CryptGenRandom; reachability on shipped Windows binaries requires compile-graph verification and is under investigation.
{
"affected": [],
"aliases": [
"CVE-2026-44040"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-01T05:16:20Z",
"severity": "MODERATE"
},
"details": "UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. In rfb/vncauth.c:119-129, the vncRandomBytes() function seeds libc rand() with time(0) + getpid() + rand() and generates a 16-byte challenge. The combined seed space is approximately 31 bits (libc rand() internal state) and is entirely determined by publicly-observable values (wall-clock time and process ID). An attacker who can observe the authentication exchange can enumerate the seed space and predict the challenge within seconds, enabling forgery or offline brute-forcing of responses. Note: on Windows, the active code path may use vncEncryptBytes2.cpp which calls CryptGenRandom; reachability on shipped Windows binaries requires compile-graph verification and is under investigation.",
"id": "GHSA-j37g-g7hg-vhg6",
"modified": "2026-07-09T06:31:59Z",
"published": "2026-07-01T06:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44040"
},
{
"type": "WEB",
"url": "https://github.com/ultravnc/UltraVNC"
},
{
"type": "WEB",
"url": "https://uvnc.com"
},
{
"type": "WEB",
"url": "https://www.securin.io/zero-days/cve-2026-44040-libc-rand-weak-rng-vnc-auth-challenge-ultravnc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Use functions or hardware which use a hardware-based random number generation for all crypto. This is the recommended solution. Use CyptGenRandom on Windows, or hw_rand() on Linux.
No CAPEC attack patterns related to this CWE.