CVE-2026-11702: Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for

highCVSS 7.5CVE-2026-11702

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.5
Published: 2026-06-26
Last updated: 2026-07-01
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-11702

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-117020.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-11702	coverage & exploitation status	NVD · CVE.org

Recent advisories for Bytes

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-59857: Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of …nvd · 2026-07-09
highCVE-2026-11404: Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server functio…nvd · 2026-07-09
mediumCVE-2026-59875: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not…nvd · 2026-07-08
highGHSA-4hgp-59h5-gvrj: ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)ghsa · 2026-07-07
criticalCVE-2026-14740: DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an in…nvd · 2026-07-07
mediumCVE-2026-53877: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.…nvd · 2026-07-07

CVE-2026-11702: Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for

Details

Exploitation outlook

Referenced CVEs

Recent advisories for Bytes

More from NVD Recent CVEs