CVE-2026-11702

EUVD-2026-39641
Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes.

When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced.

Secrets generated in multiprocess applications are predictable across processes.
PRNG
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
Common Weakness Enumeration
References
https://github.com/daoswald/Bytes-Random-Secure-Tiny/issues/6
https://github.com/daoswald/Bytes-Random-Secure-Tiny/pull/7
https://security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026-11702-r1.patch
https://www.cve.org/CVERecord?id=CVE-2026-41564