CVE-2026-11625
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jun 26, 2026
CISA due date
—
The record
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-11702 Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across… CWE-335
- CVE-2026-41564 CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after… CWE-335
- CVE-2026-25835 Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random… CWE-335
- CVE-2026-3503 Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and… CWE-335
- CVE-2025-52578 Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in… CWE-335
- CVE-2024-55566 ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with… CWE-335
- CVE-2024-36048 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CWE-335