Executive brief
Bytes::Random::Secure is a Perl library used to generate cryptographically strong random data for security purposes. A flaw in the library causes multiple background processes to generate the exact same sequences of random numbers if they were started from a single parent process. This makes security tokens, session IDs, or encryption keys predictable, potentially allowing attackers to bypass security controls in multi-process applications.
Technical details
The vulnerability is a PRNG state duplication issue (CWE-335) occurring when the library is initialized before a fork() call or when using the functional interface. Because the internal state of the Pseudo-Random Number Generator is not reset or reseeded in child processes, each fork produces identical streams of random bytes. An attacker can exploit this predictability to guess security-sensitive values like session cookies or CSRF tokens in multiprocess environments. A patch has been proposed to track the Process ID (PID) and re-instantiate the RNG when a PID change is detected.
Affected products
- DAVIDO (CPAN) Bytes::Random::Secure through 0.29
Timeline
- 2026-06-24: disclosed: Issue reported on GitHub by robrwo
- 2026-06-25: other: Patch submitted via pull request
- 2026-06-26: advisory: CVE published by CPANSec/NVD