CVE-2025-1860: Data::Entropy for Perl uses insecure rand() function for cryptographic functions

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-28 · updated 2026-06-17
Weakness: CWE-331

Description

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Affected products

ZEFRAM Data::Entropy: before 0.008 — fixed in 0.008

How to fix

Upgrade to a fixed version: ZEFRAM Data::Entropy 0.008. Check the vendor advisory for mitigations.

References

https://metacpan.org/release/ZEFRAM/Data-Entropy-0.007/source/lib/Data/Entropy.pm#L80
https://perldoc.perl.org/functions/rand
https://lists.debian.org/debian-lts-announce/2025/03/msg00026.html

Get alerted when CVE-2025-1860 or the next vulnerability affects your stack