Security Advisories (1)
CVE-2026-11702 (2026-06-26)

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.

Bytes-Random-Secure-Tiny

The minimal stuff needed from Bytes::Random::Secure, with no dependencies.

Description

This module provides a simple to use Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) built around the ISAAC algorithm. Its methods include irand for unsigned 32-bit integers, bytes for simple random bytes, and string_from for characters chosen at random from a bag of candidates. It also reliably seeds the CSPRNG from a secure source on a wide variety of platforms.

The CPAN Module Bytes::Random::Secure also produces high quality pseudo-randomness using the ISAAC cryptographically secure pseudo-random number generation algorithm, seeded using cryptographically secure entropy sources on a wide variety of operating systems. It has many configuration options. And provides both a functions and an object interface. But it has several dependencies, and its configurability and its user-interface, while flexible and useful, may expose more complexity than most use-cases require.

Bytes::Random::Secure::Tiny's goal is to have no dependencies outside of the Perl core, and a simple interface that presents a minimal amount of configuration. We asked ourselves, what are the essentials, and how can we achieve them in the most light-weight way? This module is the answer we came up with. We believe that this module will satisfy 90% of those users who were using Bytes::Random::Secure, but will do so with reduced complexity, a smaller user interface, and none of the frustration that dependencies can bring.

See the documentation for Bytes::Random::Secure::Tiny for more information.