CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking.

The Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC, …

CVE-2026-41564 affects CryptX versions before 0.088 for Perl, where cryptographic modules fail to reseed PRNG state after forking. The vulnerability causes child processes to share identical PRNG state, leading to predictable randomized operations including key generation. Two ECDSA or DSA signatures from different processes can expose the private signing key through nonce-reuse attacks. This particularly impacts preforking web servers like Starman where crypto objects are inherited by worker processes. The flaw affects multiple cryptographic modules including RSA, DSA, DH, ECC, Ed25519, and X25519 implementations.