Security

What is Predictable Value Range from Previous (CWE-343)?

Learn how to prevent and fix predictable value range vulnerabilities in your applications, including examples in Java, Node.js, Python/Django, and PHP.

Shreya Pillai July 28, 2026 5 min read Security

AI-friendly summary

What it is: Predictable Value Range from Previous Values (CWE-343) is a type of vulnerability that occurs when a random number generator produces a series of values that can be used to infer a relatively small range of possibilities for the next value that could be generated.

Why it matters: Predictable Value Range from Previous Values can compromise confidentiality, integrity, and availability of sensitive data, leading to significant business impacts.

How to fix it: You can fix Predictable Value Range from Previous Values by increasing entropy used to seed a PRNG, using products or modules that conform to FIPS 140-2, and periodically re-seeding the PRNG using input from high-quality sources.

TL;DR: Predictable Value Range from Previous Values (CWE-343) is a vulnerability that occurs when a random number generator produces predictable values, compromising confidentiality, integrity, and availability of sensitive data. You can fix it by increasing entropy used to seed a PRNG, using products or modules that conform to FIPS 140-2, and periodically re-seeding the PRNG.

What is Predictable Value Range from Previous Values?

Predictable Value Range from Previous Values (CWE-343) is a type of vulnerability that occurs when a random number generator produces a series of values that can be used to infer a relatively small range of possibilities for the next value that could be generated. This vulnerability is related to Generation of Predictable Numbers or Identifiers (CWE-340).

Quick Summary

Predictable Value Range from Previous Values (CWE-343) is a significant security risk that can compromise confidentiality, integrity, and availability of sensitive data. It occurs when a random number generator produces predictable values, making it easier for attackers to guess the next value. To fix this vulnerability, you need to increase entropy used to seed a PRNG, use products or modules that conform to FIPS 140-2, and periodically re-seed the PRNG using input from high-quality sources.

Predictable Value Range from Previous Values Overview

What: Predictable Value Range from Previous Values (CWE-343) is a type of vulnerability that occurs when a random number generator produces predictable values. Why it matters: This vulnerability can compromise confidentiality, integrity, and availability of sensitive data, leading to significant business impacts. Where it occurs: Predictable Value Range from Previous Values can occur in any application that uses a random number generator. Who is affected: Any organization that uses an application with a predictable value range vulnerability is at risk. Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected.

How Predictable Value Range from Previous Values Works

Root Cause

Predictable Value Range from Previous Values occurs when a random number generator produces a series of values that can be used to infer a relatively small range of possibilities for the next value that could be generated.

Attack Flow

The attacker observes a series of values produced by the random number generator.
The attacker uses this information to guess the next value that will be generated.
The attacker exploits the predictable value range vulnerability to gain unauthorized access or compromise sensitive data.

Prerequisites to Exploit

The following prerequisites must be true for an attacker to exploit a predictable value range vulnerability:

The random number generator produces a series of values that can be used to infer a relatively small range of possibilities for the next value.
The attacker has access to the output of the random number generator.

Vulnerable Code

import java.util.Random;

public class PredictableValueRange {
  public static void main(String[] args) {
    Random rand = new Random();
    int value = rand.nextInt(100);
    System.out.println(value);
  }
}

This code demonstrates a predictable value range vulnerability by using the Random class to generate a series of values that can be used to infer a relatively small range of possibilities for the next value.

Secure Code

import java.security.SecureRandom;

public class PredictableValueRange {
  public static void main(String[] args) {
    SecureRandom rand = new SecureRandom();
    int value = rand.nextInt(100);
    System.out.println(value);
  }
}

This code demonstrates a secure way to generate random numbers by using the SecureRandom class.

Business Impact of Predictable Value Range from Previous Values

Predictable Value Range from Previous Values can compromise confidentiality, integrity, and availability of sensitive data. This can lead to significant business impacts, including:

Compromised confidentiality: Sensitive data may be accessed or stolen.
Compromised integrity: Data may be modified or deleted without authorization.
Compromised availability: Systems or services may become unavailable.

Predictable Value Range from Previous Values Attack Scenario

The attacker observes a series of values produced by the random number generator.
The attacker uses this information to guess the next value that will be generated.
The attacker exploits the predictable value range vulnerability to gain unauthorized access or compromise sensitive data.

How to Detect Predictable Value Range from Previous Values

Manual Testing

Review code for predictable value range vulnerabilities.
Test random number generator output for predictability.

Automated Scanners (SAST/DAST)

Automated scanners can detect predictable value range vulnerabilities by analyzing the output of the random number generator and identifying patterns that may indicate predictability.

PenScan Detection

PenScan’s automated scanners can detect predictable value range vulnerabilities in your applications.

False Positive Guidance

False positives may occur when a scanner identifies a predictable value range vulnerability, but it is actually safe due to context. To avoid false positives:

Review the code and output of the random number generator carefully.
Use manual testing to verify the results of automated scanning.

How to Fix Predictable Value Range from Previous Values

Increase Entropy Used to Seed PRNG

Increase entropy used to seed a PRNG by using high-quality sources, such as hardware devices with high entropy.

Use Products or Modules that Conform to FIPS 140-2

Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems.

Periodically Re-seed PRNG Using Input from High-Quality Sources

Periodically re-seed the PRNG using input from high-quality sources, such as hardware devices with high entropy.

Framework-Specific Fixes for Predictable Value Range from Previous Values

Java

import java.security.SecureRandom;

public class PredictableValueRange {
  public static void main(String[] args) {
    SecureRandom rand = new SecureRandom();
    int value = rand.nextInt(100);
    System.out.println(value);
  }
}

Node.js

const crypto = require('crypto');

function generateRandomNumber() {
  const randomBytes = crypto.randomBytes(4);
  return parseInt(randomBytes.toString('hex'), 16) % 100;
}

console.log(generateRandomNumber());

How to Ask AI to Check Your Code for Predictable Value Range from Previous Values

Review the following [language] code block for potential CWE-343 vulnerabilities and rewrite it using a primary fix technique.

Copy-paste prompt

Review the following Java code block for potential CWE-343 Predictable Value Range from Previous Values vulnerabilities and rewrite it using a primary fix technique:

```java import java.util.Random; public class PredictableValueRange { public static void main(String[] args) { Random rand = new Random(); int value = rand.nextInt(100); System.out.println(value); } } ```

Predictable Value Range from Previous Values Best Practices Checklist

✅ Increase entropy used to seed a PRNG. ✅ Use products or modules that conform to FIPS 140-2. ✅ Periodically re-seed the PRNG using input from high-quality sources.

Predictable Value Range from Previous Values FAQ

How does Predictable Value Range from Previous Values occur?

What are the business impacts of Predictable Value Range from Previous Values?

The business impacts of Predictable Value Range from Previous Values include compromised confidentiality, integrity, and availability of sensitive data.

How can I detect Predictable Value Range from Previous Values in my application?

You can detect Predictable Value Range from Previous Values by using manual testing, automated scanners (SAST/DAST), or PenScan’s detection capabilities.

What are the framework-specific fixes for Predictable Value Range from Previous Values?

The framework-specific fixes for Predictable Value Range from Previous Values include increasing entropy used to seed a PRNG in Java and using products or modules that conform to FIPS 140-2 in Node.js.

How can I ask AI to check my code for Predictable Value Range from Previous Values?

You can ask AI to check your code for Predictable Value Range from Previous Values by reviewing the following [language] code block for potential CWE-343 vulnerabilities and rewriting it using a primary fix technique.

What are the best practices for preventing Predictable Value Range from Previous Values?

The best practices for preventing Predictable Value Range from Previous Values include increasing entropy used to seed a PRNG, using products or modules that conform to FIPS 140-2, and periodically re-seeding the PRNG using input from high-quality sources.

Some related vulnerabilities to Predictable Value Range from Previous Values include Generation of Predictable Numbers or Identifiers (CWE-340).

CWE ID	Name	Relationship
CWE-340	Generation of Predictable Numbers or Identifiers	ChildOf

References

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Predictable Value Range from Previous Values and other risks before an attacker does.