debian/haveged vulnerabilities

Latest debian/haveged CVEs

Newest publication first

1. CVE-2026-41054 Missing exit out of permission check in haveged could lead to root exploit

   Published 2026-05-20

   High·CVSS 7.8 EPSS 0.19%

   In src/havegecmd.c, the socket_handler function performs a credential check on the abstract UNIX socket (\0/sys/entropy/haveged). However, while it detects if the connecting user is not root (cred.uid != 0) and prepares a negative acknowledgement (ASCII_NAK), it fails to stop exe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.