CVE-2026-11702 - Vulnerability Details - OpenCVE

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/daoswald/Bytes-Random-Secure-Tiny/issues/6
https://github.com/daoswald/Bytes-Random-Secure-Tiny/pull/7
https://security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026-11702-r1.patch
https://www.cve.org/CVERecord?id=CVE-2026-41564

History

Fri, 26 Jun 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 26 Jun 2026 08:45:00 +0000

Type	Values Removed	Values Added
Description		Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.
Title		Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes
Weaknesses		CWE-335
References		https://github.com/daoswald/Bytes-Random-Secure-Tiny/issues/6 https://github.com/daoswald/Bytes-Random-Secure-Tiny/pull/7 https://security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026-11702-r1.patch https://www.cve.org/CVERecord?id=CVE-2026-41564

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-06-26T08:13:56.386Z

Updated: 2026-06-26T16:24:56.836Z

Reserved: 2026-06-08T22:09:13.472Z

Link: CVE-2026-11702

Vulnrichment

Updated: 2026-06-26T16:18:50.894Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11702", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-06-08T22:09:13.472Z", "datePublished": "2026-06-26T08:13:56.386Z", "dateUpdated": "2026-06-26T16:24:56.836Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Bytes-Random-Secure-Tiny", "product": "Bytes::Random::Secure::Tiny", "programFiles": ["lib/Bytes/Random/Secure/Tiny.pm"], "repo": "https://github.com/daoswald/Bytes-Random-Secure-Tiny", "vendor": "DAVIDO", "versions": [{"lessThanOrEqual": "1.011", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes.\n\nWhen an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced.\n\nSecrets generated in multiprocess applications are predictable across processes."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-335", "description": "CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-26T08:13:56.386Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://github.com/daoswald/Bytes-Random-Secure-Tiny/issues/6"}, {"tags": ["issue-tracking"], "url": "https://github.com/daoswald/Bytes-Random-Secure-Tiny/pull/7"}, {"tags": ["patch"], "url": "https://security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026-11702-r1.patch"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-41564"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-06-24T00:00:00.000Z", "value": "Issue publicly reported on GitHub"}], "title": "Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes", "workarounds": [{"lang": "en", "value": "Apply the patch, if possible.\n\nOtherwise, ensure that the object is only instantiated in a child process after forking.\n\nAlternatively, use a different module such as Crypt::PRNG, Crypt::SysRandom or Crypt::URandom."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T16:22:12.310492Z", "id": "CVE-2026-11702", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T16:24:56.836Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-11702", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T16:22:12.310492Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T16:18:50.894Z"}}], "cna": {"title": "Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/daoswald/Bytes-Random-Secure-Tiny", "vendor": "DAVIDO", "product": "Bytes::Random::Secure::Tiny", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.011"}], "packageName": "Bytes-Random-Secure-Tiny", "programFiles": ["lib/Bytes/Random/Secure/Tiny.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-24T00:00:00.000Z", "value": "Issue publicly reported on GitHub"}], "references": [{"url": "https://github.com/daoswald/Bytes-Random-Secure-Tiny/issues/6", "tags": ["issue-tracking"]}, {"url": "https://github.com/daoswald/Bytes-Random-Secure-Tiny/pull/7", "tags": ["issue-tracking"]}, {"url": "https://security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026-11702-r1.patch", "tags": ["patch"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-41564", "tags": ["related"]}], "workarounds": [{"lang": "en", "value": "Apply the patch, if possible.\n\nOtherwise, ensure that the object is only instantiated in a child process after forking.\n\nAlternatively, use a different module such as Crypt::PRNG, Crypt::SysRandom or Crypt::URandom."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes.\n\nWhen an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced.\n\nSecrets generated in multiprocess applications are predictable across processes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-335", "description": "CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-26T08:13:56.386Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11702", "state": "PUBLISHED", "dateUpdated": "2026-06-26T16:24:56.836Z", "dateReserved": "2026-06-08T22:09:13.472Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-06-26T08:13:56.386Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}