CVE-2026-11702 Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes
Predictable random numbers in forked Perl processes allow attackers to guess secrets generated by multiprocess applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11702?
CVE-2026-11702 is a high-severity vulnerability in DAVIDO Bytes::Random::Secure::Tiny, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes.
When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
Weakness: CWE-335
Which versions are affected by CVE-2026-11702?
How do I fix CVE-2026-11702?
No fix has been published for CVE-2026-11702 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11702 being exploited?
There is no known exploitation of CVE-2026-11702 in the wild and no public exploit code.
Sources
Also known as GHSA-vcwj-3q56-r32w.