Read the docs
TI-2025-01575 Aliases CVE-2025-1828GHSA-jqxq-7f92-m7ww

Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions

Priority MEDIUM 40CWE-331Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix Fixed Crypt::Random (perl): 1.56

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PerlCrypt::Random1.05 to before 1.561.56Patch availableCNA
  • Crypt::Random VendorPerl Affected 1.05 to before 1.56 Fixed in 1.56 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:timlegge:crypt\:\:random:*:*:*:*:*:perl:*:* randomVulnerableTIMLEGGE
  • cpe:2.3:a:timlegge:crypt\:\:random:*:*:*:*:*:perl:*:* Versions random Vulnerable ·TIMLEGGE

Remediation

  • Fix · CNA Crypt::Random (perl) Fixed in 1.56

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1828
  2. 2026-10-03 Alias added: GHSA-jqxq-7f92-m7ww

References

Patch 3

  • TI-2021-05190 Code injection in ExifTool KEVCVSS 3.1HIGH 7.8
  • TI-2022-24100 In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead… CVSS 3.1CRITICAL 9.8
  • TI-2012-05140 The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl… CVSS 2.0HIGH 7.5
  • TI-2025-27303 Untrusted search path in perl CVSS 3.1MEDIUM 5.9
  • TI-2018-12932 Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
  • TI-2018-12931 Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences