CVE-2026-11625
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
- Record
CVE-2026-11625- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-335
- Updated
- 2026-11-02
EUVDEUVD-2026-39640
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
- Record
EUVD-2026-39640- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r57w-h3mc-4jrv
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes...
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
- Record
GHSA-r57w-h3mc-4jrv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-335
- Updated
- 2026-11-02
NVD
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
- Record
CVE-2026-11625- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-335
- Updated
- 2026-11-02
OSV
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
- Record
CVE-2026-11625- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-335
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-11625
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.
- Record
DEBIAN-CVE-2026-11625- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-11625
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.
- Record
UBUNTU-CVE-2026-11625- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVAZL-91571 No score
CVE-2026-11625 affecting package perl-Bytes-Random-Secure for versions less than 0.29-22
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
- Record
AZL-91571- Updated
- 2026-11-05
OSVMGASA-2026-0266 No score
Updated perl-Bytes-Random-Secure package fixes a security vulnerability
The updated package fixes a security vulnerability: Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. (CVE-2026-11625)
- Record
MGASA-2026-0266- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-Bytes-Random-SecureAzure Linux:3 |
before 0.29-22 | 0.29-22 |
libbytes-random-secure-perlDebian:12 |
before 0.29-4~deb13u1~deb12u1, plus listed versions 0.29-3 |
0.29-4~deb13u1~deb12u1 |
libbytes-random-secure-perlDebian:13 |
before 0.29-4~deb13u1, plus listed versions 0.29-30.29-4~deb13u1~deb12u1 |
0.29-4~deb13u1 |
libbytes-random-secure-perlDebian:14 |
before 0.29-4, plus listed versions 0.29-30.29-4~deb13u10.29-4~deb13u1~deb12u1 |
0.29-4 |
perl-Bytes-Random-SecureMageia:10 |
before 0.290.0-7.1.mga10 | 0.290.0-7.1.mga10 |
perl-Bytes-Random-SecureMageia:9 |
before 0.290.0-6.1.mga9 | 0.290.0-6.1.mga9 |
libbytes-random-secure-perlUbuntu:14.04:LTS |
All versions, plus listed versions 0.26-10.27-10.28-1 |
None known |
libbytes-random-secure-perlUbuntu:16.04:LTS |
All versions, plus listed versions 0.28-1 |
None known |
libbytes-random-secure-perlUbuntu:18.04:LTS |
All versions, plus listed versions 0.28-1 |
None known |
libbytes-random-secure-perlUbuntu:20.04:LTS |
All versions, plus listed versions 0.29-1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libbytes-random-secure-perlUbuntu:22.04:LTS |
All versions, plus listed versions 0.29-1 |
None known |
libbytes-random-secure-perlUbuntu:24.04:LTS |
All versions, plus listed versions 0.29-3 |
None known |
libbytes-random-secure-perlUbuntu:25.10 |
All versions, plus listed versions 0.29-3 |
None known |
libbytes-random-secure-perlUbuntu:26.10 |
All versions, plus listed versions 0.29-30.29-4 |
None known |
libbytes-random-secure-perlUbuntu:26.04:LTS |
All versions, plus listed versions 0.29-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-11625 is a high vulnerability (CVSS 7.5) in Davido Bytes::random::secure, published June 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in perl-Bytes-Random-Secure 0.29-22.
References
github.com/daoswald/Bytes-Random-Secure/issues/3
security.metacpan.org/patches/B/Bytes-Random-Secure/0.29/CVE-2026-11625-r1.patch
cve.org/CVERecord?id=CVE-2026-11702
nvd.nist.gov/vuln/detail/CVE-2026-11625
Show 11 moreShow less
cpan.org/modules
security-tracker.debian.org/tracker/CVE-2026-11625
advisories.mageia.org/MGASA-2026-0266.html
bugs.mageia.org/show_bug.cgi?id=35767
openwall.com/lists/oss-security/2026/06/26/5
ubuntu.com/security/CVE-2026-11625
lists.security.metacpan.org/cve-announce/msg/41305966