Executive brief
Bytes::Random::Secure::Tiny is a Perl library used to generate cryptographically secure random data. A flaw in the library causes multiple sub-processes to generate the exact same sequence of "random" numbers if the generator was started before the application split into multiple tasks. In practice, this allows an attacker to predict sensitive security tokens, session keys, or passwords generated by the application, leading to potential account takeovers or data breaches.
Technical details
The Bytes::Random::Secure::Tiny library fails to reset its internal Pseudo-Random Number Generator (PRNG) state following a fork() system call. When a PRNG object is initialized in a parent process, the internal state is duplicated exactly into child processes, causing them to produce identical streams of random bytes. This is a classic PRNG state duplication issue (CWE-335). An attacker can exploit this in multi-process applications to predict "random" values such as session IDs or CSRF tokens. A patch has been proposed to track the Process ID (PID) and re-instantiate the RNG if a PID change is detected.
Affected products
- DAVIDO Bytes::Random::Secure::Tiny through 1.011
Timeline
- 2026-06-24: disclosed: Issue reported on GitHub repository
- 2026-06-26: advisory: CVE-2026-11702 published