CWE-333: Improper Handling of Insufficient Entropy in TRNG
True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
Last updated
Overview
The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.
Real-world CVEs
1 recorded CVEs are caused by CWE-333 (Improper Handling of Insufficient Entropy in TRNG). The highest-severity and most recent are shown first. 0 new CWE-333 CVEs have been recorded so far in 2026 (1 in 2025).
Common consequences
What can happen when CWE-333 is exploited.
DoS: Crash, Exit, or Restart
Affects: Availability
A program may crash or block if it runs out of random numbers.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
How to prevent it
Practical mitigations for CWE-333, grouped by where in the lifecycle they apply.
Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.
Code examples
MITRE examples of the weakness in code.
This code uses a TRNG to generate a unique session id for new connections to a server:
Vulnerable example
while (1){This code does not attempt to limit the number of new connections or make sure the TRNG can successfully generate a new random number. An attacker may be able to create many new connections and exhaust the entropy of the TRNG. The TRNG may then block and cause the program to crash or hang.
Terminology & mappings
Mapped taxonomies
- CLASP: Failure of TRNG
- The CERT Oracle Secure Coding Standard for Java (2011): Generate strong random numbers (MSC02-J)
Frequently asked questions
Common questions about CWE-333.
- What is CWE-333?
- True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
- What CVEs are caused by CWE-333?
- 1 recorded CVEs are attributed to CWE-333, including CVE-2025-62626.
- How do you prevent CWE-333?
- Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.
- What are the consequences of CWE-333?
- Exploiting CWE-333 can lead to: DoS: Crash, Exit, or Restart.
- Is CWE-333 actively exploited?
- 1 recorded CVEs are caused by CWE-333; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-333) (opens in a new tab)
- CWE-333 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Track CWE-333 CVEs
Get an alert when a new CWE-333 CVE affects your products, with AI-written analysis and remediation steps.