CVE-2026-11625 Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
Predictable random numbers in forked Perl processes allow attackers to guess secrets generated by the Bytes::Random::Secure library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-11625?
CVE-2026-11625 is a high-severity vulnerability in DAVIDO Bytes::Random::Secure, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
Weakness: CWE-335
Which versions are affected by CVE-2026-11625?
How do I fix CVE-2026-11625?
Upgrade to a fixed version.
Is CVE-2026-11625 being exploited?
There is no known exploitation of CVE-2026-11625 in the wild and no public exploit code.
Sources
Also known as AZL-91571, DEBIAN-CVE-2026-11625, GHSA-r57w-h3mc-4jrv, MGASA-2026-0266, UBUNTU-CVE-2026-11625.