CVE-2020-35926
highpriority · track · 40OT risk · elevatedEPSS 0.015 · 75 %ileEUUSEPSS · scored 2026-10-27
An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishandled.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.1–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-m9m5-cg5h-r582Improper random number generation in nanorand2021-08-25ghsa · osvUS
In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the cryptographically secure ChaCha random number generator.
- RUSTSEC-2020-0089nanorand 0.5.0 - RNGs failed to generate properly for non-64-bit numbers2020-12-09vendor · osvUS
In versions of `nanorand` prior to 0.5.1, `RandomGen` implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an `as` conversion. This often manifested as RNGs returning nothing but 0, including the cryptographically secure `ChaCha` random number generator..
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan