Junglewise Threat Intelligence

CVE-2026-11625: Perl Bytes::Random::Secure predictable PRNG state after fork

CVE-2026-11625 · Severity: info · CVSS 0 · Published 2026-06-26

Executive brief

Bytes::Random::Secure is a Perl library used to generate cryptographically strong random data for security purposes. A flaw in the library causes multiple background processes to generate the exact same sequences of random numbers if they were started from a single parent process. This makes security tokens, session IDs, or encryption keys predictable, potentially allowing attackers to bypass security controls in multi-process applications.

Technical details

The vulnerability is a PRNG state duplication issue (CWE-335) occurring when the library is initialized before a fork() call or when using the functional interface. Because the internal state of the Pseudo-Random Number Generator is not reset or reseeded in child processes, each fork produces identical streams of random bytes. An attacker can exploit this predictability to guess security-sensitive values like session cookies or CSRF tokens in multiprocess environments. A patch has been proposed to track the Process ID (PID) and re-instantiate the RNG when a PID change is detected.

Affected products

  • DAVIDO (CPAN) Bytes::Random::Secure through 0.29

Timeline

  • 2026-06-24: disclosed: Issue reported on GitHub by robrwo
  • 2026-06-25: other: Patch submitted via pull request
  • 2026-06-26: advisory: CVE published by CPANSec/NVD

References