Older releases of the Perl module Data::Entropy obtain random data from the services RandomOrg and RandomnumbersInfo via unencrypted HTTP connections. The integrity checks for these sources are minimal; the RandomOrg source accepts any non‑empty payload, and no cryptographic verification is performed, reflecting a CWE‑319 weakness in cleartext transmission of sensitive data. The vulnerability also aligns with CWE‑353 because the module’s check for valid data is trivial and does not enforce proper integrity verification, allowing an attacker to supply any non-empty bytes. Consequently, an attacker able to intercept or modify traffic on the network path can replace the data returned by the module’s rand_bits and rand_int functions with attacker‑chosen values, altering the randomness consumed by the application.

All installations that use Data::Entropy versions earlier than 0.010 and that import the RawSource::RandomOrg or RandomnumbersInfo modules are affected. These include the deprecated 0.008 and 0.009 releases. Because the module is no longer maintained after 0.008, legacy projects that continue to use it remain at risk.

The vulnerability requires a man‑in‑the‑middle or other on‑path attacker (e.g., open Wi‑Fi, compromised ISP, captive portal, or hostile egress proxy) that can intercept the HTTP requests used by the module. By supplying crafted responses, the attacker can dictate the bits returned by rand_bits and rand_int and influence the retry/sleep logic via the _checkbuf method. The CVSS score of 7.5 reflects a high severity classification, while the EPSS score of < 1% indicates that exploitation is unlikely but still possible. The issue is not listed in the CISA KEV catalog. The lack of integrity verification and the ability to supply chosen randomness suggest a high potential impact if the random data is used for cryptographic or security‑critical purposes.