Skip to content
OpenAdvisories

Weakness (CWE)

CWE-331: Insufficient Entropy

Base Draft

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

How to prevent it (1 mitigation)

  1. Implementation

    Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.

Source: MITRE CWE-331

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.8
    CVE-2026-1814 Public exploit

    Rapid7 Nexpose Insecure Java Keystore Password Generation

    Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient le…

    Rapid7 InsightVM/Nexpose