CVE-2024-57854CWE-338

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator

Critical · published March 5, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.

Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors.

Data::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00426 · 35.8th percentile
Weakness
CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2026-03-05T02:18Z
EPSS history
Timeline
  • 05 MAR 02:18Z
    Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator
    cvelistv5