https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:40:38.819129+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-228805 EUVD-2026-228805 2026-10-03T03:40:39.312771+00:00 EUVD-2026-228805 https://cve.radiocsirt.org/vuln/fkie_cve-2021-4238 fkie_cve-2021-4238 2026-10-03T03:40:39.312824+00:00

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.

 https://cve.radiocsirt.org/vuln/ghsa-xg2h-wx96-xgxr GHSA-xg2h-wx96-xgxr — RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be 2026-10-03T03:40:39.312859+00:00

Affected: Go: github.com/Masterminds/goutils

### Impact

A security-sensitive bug was discovered by Open Source Developer *Erik Sundell of Sundell Open Source Consulting AB*.

The functions `RandomAlphaNumeric(int)` and `CryptoRandomAlphaNumeric(int)` are not as random as they should be. Small values of `int` in the functions above will return a smaller subset of results than they should. For example, `RandomAlphaNumeric(1)` will always return a digit in the 0-9 range, while `RandomAlphaNumeric(4)` will return around ~7 million of the ~13M possible permutations.

This is considered a security release because programs that rely upon random generators for passwords are at an increased risk of brute force-style password guessing. There is also a higher probability of collision.

The problem was the result of a mistaken regular expression that only accepted random strings if they contained a digit from `[0-9]`. That restriction has been removed.

### Patches

This issue has been corrected in v1.1.1.

### Workarounds

If you cannot upgrade to v1.1.1, you can work around the issue by calling `RandomAlphaNumericCustom(N, true, true)`|`CryptoRandomAlphaNumericCustom(N, true, true)` instead. (Where `N` is the desired length, and `true` is the literal boolean `true`.)

 https://cve.radiocsirt.org/vuln/gsd-2021-4238 gsd-2021-4238 2026-10-03T03:40:39.312897+00:00 gsd-2021-4238 https://cve.radiocsirt.org/vuln/msrc_cve-2021-4238 msrc_CVE-2021-4238 — Insufficient randomness in github.com/Masterminds/goutils 2026-10-03T03:40:39.312910+00:00 msrc_CVE-2021-4238 https://cve.radiocsirt.org/vuln/rhsa-2023:0449 RHSA-2023:0449 — Red Hat Security Advisory: OpenShift Container Platform 4.12.1 security update 2026-10-03T03:40:39.312927+00:00

goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-4238 UBUNTU-CVE-2021-4238 2026-10-03T03:40:39.312943+00:00

Affected: Ubuntu:22.04:LTS: golang-github-masterminds-goutils, Ubuntu:24.04:LTS: golang-github-masterminds-goutils, Ubuntu:25.10: golang-github-masterminds-goutils, Ubuntu:26.04:LTS: golang-github-masterminds-goutils

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0224 WID-SEC-W-2023-0224 — Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen 2026-10-03T03:40:39.312969+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen.