CVE-2026-11625

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11625
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11625.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11625
Downstream
Published
2026-06-26T08:07:30.141Z
Modified
2026-08-12T03:51:23.162446994Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
Details

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.

When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.

Secrets generated in multiprocess applications are predictable across processes.

Database specific 
{
    "cwe_ids": [
        "CWE-335"
    ],
    "cna_assigner": "CPANSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11625.json"
}
References

Affected packages

Git / github.com/daoswald/bytes-random-secure

Affected ranges

Type
GIT
Repo
https://github.com/daoswald/bytes-random-secure
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0ef089a8fbf0412f3a7d1d95f64d78b94446191b
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.29"
        },
        {
            "fixed": "0.29"
        }
    ]
}

Affected versions

v0.*
v0.01
v0.02
v0.03
v0.05
v0.06
v0.07
v0.08
v0.09
v0.10
v0.11
v0.12
v0.20
v0.21
v0.23
v0.24
v0.25
v0.26
v0.27

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11625.json"