CVE-2026-11625
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.51%
- CWE
- CWE-335
- Published
- 2026-06-26
- Last modified
- 2026-07-01
Affected products
- DAVIDO Bytes::Random::Secure
Weakness type
Related vulnerabilities
- CVE-2026-11702 — Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes
- CVE-2026-41564 — CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking
- CVE-2026-3503 — Fault injection attack with ML-DSA and ML-KEM on ARM
- CVE-2025-52578 — Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec...
- CVE-2025-27580 — NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates...
- CVE-2025-24783 — Apache Cocoon: continuations may not be private
- CVE-2024-55566 — ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name...
- CVE-2024-1579 — Insufficient seeding of random number generator