What is CVE-2020-35926?

CVE-2020-35926 is a critical-severity vulnerability in Nanorand_project Nanorand, classified under Use of Insufficiently Random Values. CVSS score: 9.8/10. Published 2020-12-31.

How severe is CVE-2020-35926?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2020-35926 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Nanorand_project Nanorand

CVE-2020-35926

An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishandled.

EPSS: 0.015 (71.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Nanorand_project Nanorand
N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

Artisan-Lab/Rust-memory-safety-bugs

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-35926?: CVE-2020-35926 is a critical-severity vulnerability in Nanorand_project Nanorand, classified under Use of Insufficiently Random Values. CVSS score: 9.8/10. Published 2020-12-31.
How severe is CVE-2020-35926?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2020-35926 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.