GHSA-3fmq-x9q6-wm39
random_compat Uses insecure CSPRNG
GHSA-3fmq-x9q6-wm39 is a vulnerability with no CVSS score yet in paragonie/random_compat, published May 17, 2024. No source lists public exploit code. Fixed in paragonie/random_compat 2.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0paragonie/random_compat +1 more
Description
random_compat versions prior to 2.0 are affected by a security vulnerability related to the insecure usage of Cryptographically Secure Pseudo-Random Number Generators (CSPRNG). The affected versions use openssl_random_pseudo_bytes(), which may result in insufficient entropy and compromise the security of generated random numbers.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
paragonie/random_compatPackagist | before 2.0 | 2.0 |
paragonie/random_compatPackagist | before 2.0, plus listed versions 0.9.00.9.10.9.20.9.30.9.4 Show 30 moreShow less0.9.51.0.101.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.51.1.6v0.9.7v1.0.0v1.0.1v1.2.0v1.2.1v1.2.2v1.2.3v1.3.0v1.3.1v1.4.0v1.4.1v1.4.2v1.4.3 | 2.0 |
What each source reports
GitHub AdvisoriesNo score
random_compat Uses insecure CSPRNG
random_compat versions prior to 2.0 are affected by a security vulnerability related to the insecure usage of Cryptographically Secure Pseudo-Random Number Generators (CSPRNG). The affected versions use openssl_random_pseudo_bytes(), which may result in insufficient entropy and compromise the security of generated random numbers.
- Record
GHSA-3fmq-x9q6-wm39- Weakness
- CWE-331
- Updated
- 2026-11-02
OSVNo score
random_compat Uses insecure CSPRNG
random_compat versions prior to 2.0 are affected by a security vulnerability related to the insecure usage of Cryptographically Secure Pseudo-Random Number Generators (CSPRNG). The affected versions use openssl_random_pseudo_bytes(), which may result in insufficient entropy and compromise the security of generated random numbers.
- Record
GHSA-3fmq-x9q6-wm39- Weakness
- CWE-331
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.