CVE-2019-10064: Debian Linux

High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days.

hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• w1.fi Hostapd: before 2.6 (fixed in 2.6)

Published 2020-02-28. Last modified 2026-06-17.