CVE-2026-11702
Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.51%
- CWE
- CWE-335
- Published
- 2026-06-26
- Last modified
- 2026-07-01
Affected products
- DAVIDO Bytes::Random::Secure::Tiny
Weakness type
Related vulnerabilities
- CVE-2026-11625 — Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
- CVE-2026-41564 — CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking
- CVE-2026-3503 — Fault injection attack with ML-DSA and ML-KEM on ARM
- CVE-2025-52578 — Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec...
- CVE-2025-27580 — NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates...
- CVE-2025-24783 — Apache Cocoon: continuations may not be private
- CVE-2024-55566 — ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name...
- CVE-2024-1579 — Insufficient seeding of random number generator