Skip to content
OpenAdvisories

Weakness (CWE)

CWE-331: Insufficient Entropy

Base Draft

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

How to prevent it (1 mitigation)

  1. Implementation

    Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.

Source: MITRE CWE-331

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-71851 Public exploit

    crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

    crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), in…

    brix crypto-js crypto-js cryptojs Debian Ubuntu npm
  • Critical 9.5
    CVE-2025-52464 Public exploit

    Meshtastic Repeated Public and Private Keypairs

    Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize…

    meshtastic firmware