Variant weakness
Draft
CWE-333: Improper Handling of Insufficient Entropy in TRNG
True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
Last updated
1
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Low
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.
Real-world CVEs
1 recorded CVEs are caused by CWE-333 (Improper Handling of Insufficient Entropy in TRNG). The highest-severity and most recent are shown first. 0 new CWE-333 CVEs have been recorded so far in 2026 (1 in 2025).
Common consequences
What can happen when CWE-333 is exploited.
DoS: Crash, Exit, or Restart
Affects: Availability
A program may crash or block if it runs out of random numbers.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Architecture and Design
Implementation