Random Stream Predictability in Bytes::Random::Secure::Tiny by Perl

CVE-2026-11702

What is CVE-2026-11702?

The Bytes::Random::Secure::Tiny module for Perl has a vulnerability that arises when internal state is shared across forked processes. Specifically, if an instance of the object is initialized prior to forking, it causes all child processes to share the same internal state of the pseudo-random number generator (PRNG). This leads to predictable random streams in multiprocess applications, making sensitive data like secrets susceptible to exposure. When using this module, developers should avoid pre-fork initialization or upgrade to patched versions to ensure secure random number generation.

References