CVE-2024-58041

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions.

Smolder 1.51 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Specifically Smolder::DB::Developer uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-338

Affected software

No affected versions have been published.

Timeline

Published
Feb 24, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-580425.5In the Linux kernel, the following vulnerability has been resolved: rhashtable: Fix potential deadlock by moving schedule_work outside lockCVE-2024-580435.5Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentialitCVE-2024-580445.5Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect avaCVE-2024-580454.7Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may aCVE-2024-580465.5Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confiCVE-2024-580475.5Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service cCVE-2024-580484.7Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availabCVE-2024-580495.5Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service cCVE-2024-58059.1Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit GatewCVE-2024-580505.5Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confiCVE-2024-580515.5In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: Add check devm_kasprintf() returned value devm_kasprintf()CVE-2024-580525.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_
CVE-2024-58041: Critical severity, CVSS 9.1 | Vulnix