CVE-2026-11625: Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface i

highCVSS 7.5CVE-2026-11625

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.5
Published: 2026-06-26
Last updated: 2026-07-01
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-11625

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-116250.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-11625	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Bytes

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-59857: Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of …nvd · 2026-07-09
highCVE-2026-11404: Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server functio…nvd · 2026-07-09
mediumCVE-2026-59875: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not…nvd · 2026-07-08
highGHSA-4hgp-59h5-gvrj: ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)ghsa · 2026-07-07
criticalCVE-2026-14740: DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an in…nvd · 2026-07-07
mediumCVE-2026-53877: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.…nvd · 2026-07-07