CVE-2026-11625CWE-335

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes

High · published June 26, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
41.6
In the wild
Unconfirmed
What it is

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.

When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.

Secrets generated in multiprocess applications are predictable across processes.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00508 · 41.6th percentile
Weakness
CWE-335 · Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
Published
2026-06-26T08:07Z
EPSS history
Timeline
  • 26 JUN 08:07Z
    Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
    cvelistv5