The vulnerability in CryptX (before version 0.088) arises because the Crypt::PK modules (including RSA, DSA, DH, ECC, Ed25519, and X25519) initialize a per-object PRNG state at construction and reuse it without detecting process forks. When a process forks, the child inherits the parent's PRNG state without reseeding, causing identical pseudo-random outputs across processes. This flaw enables attackers to recover private keys from multiple signatures generated by different child processes due to nonce reuse, compromising cryptographic security in preforking environments such as the Starman web server.

The vulnerability allows an attacker to recover private signing keys by analyzing multiple signatures generated by different child processes sharing the same PRNG state. This compromises the confidentiality of private keys used in ECDSA or DSA signatures, potentially enabling signature forgery or impersonation. The impact is limited to environments where Crypt::PK objects are created before forking, such as preforking web servers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid creating Crypt::PK::* objects before forking in preforking services. Alternatively, ensure that PRNG states are properly reseeded in child processes after fork to prevent nonce reuse. Monitor vendor channels for updates and apply patches once released.