Live › vulnerability › CVE-2026-112041
Go to dashboardThe dmString::random helper in diem's dmCorePlugin generates strings with a non-cryptographic random number generator. An attacker who can observe enough outputs may be able to predict values that the application expects to be secret or unguessable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only applications built on diem that call dmString::random for security-sensitive values are exposed. The sources do not name a fixed release, and the project has not responded to the report. Installations that never call this helper for secrets can skip it.
No product ranges from the sources yet.
dmString::random in dmCorePlugin/lib/basic/dmString.php.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112041")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.