Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes
Summary
| CVE | CVE-2026-11702 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-26 09:16:33 UTC |
| Updated | 2026-06-26 17:16:31 UTC |
| Description | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-335 | CWE-335 CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | DAVIDO | BytesRandomSecureTiny | affected 1.011 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/daoswald/Bytes-Random-Secure-Tiny/pull/7 | 9b29abf9-4ab0-4765-b253-1875cd9b441e | github.com | |
| security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026-11702-r1.patch | 9b29abf9-4ab0-4765-b253-1875cd9b441e | security.metacpan.org | |
| github.com/daoswald/Bytes-Random-Secure-Tiny/issues/6 | 9b29abf9-4ab0-4765-b253-1875cd9b441e | github.com | |
| www.cve.org/CVERecord | 9b29abf9-4ab0-4765-b253-1875cd9b441e | www.cve.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-06-24T00:00:00.000Z | Issue publicly reported on GitHub |
Workarounds
CNA: Apply the patch, if possible. Otherwise, ensure that the object is only instantiated in a child process after forking. Alternatively, use a different module such as Crypt::PRNG, Crypt::SysRandom or Crypt::URandom.
There are currently no legacy QID mappings associated with this CVE.