CVE-2026-8700: Perl Rand For Cryptographic Bytes
Generating bytes with Perl's built-in rand() (e.g. `chr rand 256`) is insecure for any cryptographic purpose. Perl's rand() is a non-CSPRNG with a small, predictable internal state; bytes derived from it can be reproduced or brute-forced by an attacker. Use an OS CSPRNG such as Crypt::SysRandom::random_bytes(), Crypt::URandom, or Crypt::PRNG instead.
greprules fetch cve-2026-8700-perl-rand-for-cryptographic-bytes --engine opengrepDescription
Generating bytes with Perl's built-in rand() (e.g. `chr rand 256`) is insecure for any cryptographic purpose. Perl's rand() is a non-CSPRNG with a small, predictable internal state; bytes derived from it can be reproduced or brute-forced by an attacker. Use an OS CSPRNG such as Crypt::SysRandom::random_bytes(), Crypt::URandom, or Crypt::PRNG instead.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.