Common Weakness Enumeration

CWE-331 Insufficient Entropy

Description

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-331 ordered by modification date.

25 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-rg76-677x-56q9	CVE-2026-71851	CRITICAL	npm/crypto-js	crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain	2026-08-07
GHSA-rq8g-5pc5-wrhr	CVE-2018-1000620	CRITICAL	npm/cryptiles	Insufficient Entropy in cryptiles	2026-06-08
GHSA-2cwr-gcf9-pvxr	CVE-2026-42155	CRITICAL	-	Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs	2026-05-15
GHSA-ghc5-95c2-vwcv	-	HIGH	-	Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption	2026-04-03
GHSA-vfpx-q664-h93m	-	HIGH	-	Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption	2026-04-03
GHSA-fmg6-246m-9g2v	-	HIGH	-	Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption	2026-04-03
GHSA-w3wc-44p4-m4j7	CVE-2026-34236	HIGH	-	Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption	2026-04-01
GHSA-434v-x5qv-pmh6	-	HIGH	-	libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure	2026-03-26
GHSA-3w3w-pxmm-2w2j	CVE-2020-36732	MODERATE	npm/crypto-js	crypto-js uses insecure random numbers	2026-03-16
GHSA-2hfw-w739-p7x5	-	CRITICAL	-	Duplicate Advisory: nano-id reduced entropy due to inadequate character set usage	2026-02-02
GHSA-xg2h-wx96-xgxr	CVE-2021-4238	LOW	golang/github.com/Masterminds/goutils	RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be	2026-01-23
GHSA-3839-6r69-m497	-	CRITICAL	golang/github.com/Masterminds/goutils	Duplicate Advisory: GoUtils's randomly-generated alphanumeric strings contain significantly less entropy than expected	2026-01-23
GHSA-w3g8-fp6j-wvqw	CVE-2026-22698	HIGH	-	SM2-PKE has 32-bit Biased Nonce Vulnerability	2026-01-11
GHSA-m98w-cqp3-qcqr	CVE-2025-66565	CRITICAL	golang/github.com/gofiber/utils golang/github.com/gofiber/utils/v2	Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values	2025-12-12
GHSA-w8cc-3h7q-jhc3	CVE-2017-18883	MODERATE	golang/github.com/mattermost/mattermost-server	Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider	2025-12-05
GHSA-wqcc-qf63-c2x4	CVE-2023-49599	CRITICAL	-	WWBN AVideo Insufficient Entropy vulnerbaility	2025-11-04
GHSA-p5jq-5383-qvc7	CVE-2025-59015	MODERATE	-	TYPO3 CMS uses insufficient entropy when generating passwords	2025-09-10
GHSA-8q6v-474h-whgg	CVE-2025-54885	MODERATE	npm/thinbus-srp	The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended	2025-08-07
GHSA-5844-q3fc-56rh	CVE-2023-26154	MODERATE	gem/pubnub golang/github.com/pubnub/go golang/github.com/pubnub/go/v5 golang/github.com/pubnub/go/v6 golang/github.com/pubnub/go/v7 maven/com.pubnub/pubnub maven/com.pubnub/pubnub-kotlin npm/pubnub nuget/Pubnub pypi/pubnub	pubnub Insufficient Entropy vulnerability	2025-07-22
GHSA-4crf-28c7-v4gr	CVE-2024-6508	MODERATE	golang/github.com/openshift/console	Openshift Console insufficient entropy vulnerability	2025-01-09
GHSA-gq9m-qvpx-68hc	CVE-2019-14806	HIGH	pypi/werkzeug	Pallets Werkzeug Insufficient Entropy	2024-11-19
GHSA-x345-32rc-8h85	CVE-2021-29471	MODERATE	pypi/matrix-synapse	Denial of service attack via push rule patterns in matrix-synapse	2024-09-30
GHSA-chg9-3c3p-ch23	CVE-2015-7764	HIGH	pypi/lemur	Lemur uses static IV per key	2024-09-30
GHSA-qjxf-mc72-wjr2	CVE-2024-8796	MODERATE	gem/devise-two-factor	Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length	2024-09-20
GHSA-9hc7-6w9r-wj94	CVE-2024-36400	CRITICAL	-	Unable to generate the correct character set	2024-06-17