CVE-2024-58041

CRITICAL

Smolder <=1.51 - Insecure Randomness

Title source: llm
STIX 2.1

Description

Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions. Smolder 1.51 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Smolder::DB::Developer uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.

Scores

CVSS v3 9.1
EPSS 0.0004
EPSS Percentile 12.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-338
Status published
Products (1)
wonko/smolder < 1.51
Published Feb 24, 2026
Tracked Since Feb 24, 2026