Security Advisories (1)
CVE-2026-11702 (2026-06-26)

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.

Bytes-Random-Secure-Tiny

The minimal stuff needed from Bytes::Random::Secure, with no dependencies.

Description

The CPAN Module Bytes::Random::Secure produces high quality pseudo-randomness using the ISAAC cryptographically secure pseudo-random number generation algorithm, seeded using cryptographically secure entropy sources on a wide variety of operating systems. It has many configuration options. And provides both a functions and an object interface. But it has several dependencies, and its configurability and its user-interface, while flexible and useful, may expose more complexity than most use-cases require.

Bytes::Random::Secure::Tiny's goal is to have no dependencies outside of the Perl core, and a simple interface that presents a minimal amount of configuration. We asked ourselves, what are the essentials, and how can we achieve them in the most light-weight way? This module is the answer we came up with. We believe that this module will satisfy 90% of those users who were using Bytes::Random::Secure, but will do so with reduced complexity, a smaller user interface, and none of the frustration that dependencies can bring.