CVE catalog

CVE-2026-16615

Severity: Medium · CVSS 6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Published: Jun 8, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.43% · Oct 25, 2026

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	librest	sid	`0.10.2-1`	vulnerable
Debian	librest	forky	`0.10.2-1`	vulnerable
Debian	librest	trixie	`0.9.1-6`	vulnerable
Debian	librest	bookworm	`0.9.1-6`	vulnerable
Suse	librest	linux enterprise server 16.0	`0.9.1-160000.3.1`	fixed
Suse	librest	linux enterprise server for sap applications 16.0	`0.9.1-160000.3.1`	fixed
Suse	librest0_7	linux enterprise workstation extension 15 sp7	`0.8.1-150600.4.3.1`	fixed
Opensuse	librest	leap 16.0	`0.9.1-160000.3.1`	fixed
Suse	librest	linux enterprise server ltss extended security 12 sp5	`0.8.0-13.3.1`	fixed
Suse	librest	linux enterprise module for desktop applications 15 sp7	`0.9.1-150600.3.3.1`	fixed
Opensuse	librest0_7	leap 16.0	`0.8.1-bp160.2.1`	fixed
Opensuse	librest	tumbleweed	`0.10.2-2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	librest	source	sid	`(unfixed)`	not yet assigned	Not reported	[1142715]
Debian	librest	source	forky	`(unfixed)`	not yet assigned	Not reported	[1142715]
Debian	librest	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1142715]
Debian	librest	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1142715]
Suse	librest	rpm	linux enterprise server 16.0	`0.9.1-160000.3.1`	Not reported	SUSE-SU-2026:23564-1	Not reported
Suse	librest	rpm	linux enterprise server for sap applications 16.0	`0.9.1-160000.3.1`	Not reported	SUSE-SU-2026:23564-1	Not reported
Suse	librest0_7	rpm	linux enterprise workstation extension 15 sp7	`0.8.1-150600.4.3.1`	Not reported	SUSE-SU-2026:3834-1	Not reported
Opensuse	librest	rpm	leap 16.0	`0.9.1-160000.3.1`	Not reported	OPENSUSE-SU-2026:21694-1	Not reported
Suse	librest	rpm	linux enterprise server ltss extended security 12 sp5	`0.8.0-13.3.1`	Not reported	SUSE-SU-2026:3796-1	Not reported
Suse	librest	rpm	linux enterprise module for desktop applications 15 sp7	`0.9.1-150600.3.3.1`	Not reported	SUSE-SU-2026:3795-1	Not reported
Opensuse	librest0_7	rpm	leap 16.0	`0.8.1-bp160.2.1`	Not reported	OPENSUSE-SU-2026:21563-1	Not reported
Opensuse	librest	rpm	tumbleweed	`0.10.2-2.1`	Not reported	OPENSUSE-SU-2026:11477-1	Not reported

[Debian bug #1142715]

Notes

[trixie] librest: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-rest-1.0]Affected
Source package: [librest]
Details (2)
- 0.9.1-6 · amd64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
- 0.9.1-6 · arm64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
[gir1.2-restextras-1.0]Affected
Source package: [librest]
Details (2)
- 0.9.1-6 · amd64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
- 0.9.1-6 · arm64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
[librest-1.0-0]Affected
Source package: [librest]
Details (2)
- 0.9.1-6 · amd64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
- 0.9.1-6 · arm64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
[librest-dev]Affected
Source package: [librest]
Details (2)
- 0.9.1-6 · amd64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
- 0.9.1-6 · arm64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
[librest-doc]Affected
Source package: [librest]
Details (2)
- 0.9.1-6 · all · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
- 0.9.1-6 · all · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
[librest-extras-1.0-0]Affected
Source package: [librest]
Details (2)
- 0.9.1-6 · amd64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
- 0.9.1-6 · arm64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
[librest-extras-dev]Affected
Source package: [librest]
Details (2)
- 0.9.1-6 · amd64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12
- 0.9.1-6 · arm64 · bookworm
  Affected
  nvd · librest · debian · bookworm; nvd · librest · debian · 12

[Debian 13 (Trixie)]

[gir1.2-rest-1.0]Affected
Source package: [librest]
Details (2)
- 0.9.1-6+b2 · amd64 · trixie
  Affected
  nvd · librest · debian · 13
- 0.9.1-6+b2 · arm64 · trixie
  Affected
  nvd · librest · debian · 13
[gir1.2-restextras-1.0]Affected
Source package: [librest]
Details (2)
- 0.9.1-6+b2 · amd64 · trixie
  Affected
  nvd · librest · debian · 13
- 0.9.1-6+b2 · arm64 · trixie
  Affected
  nvd · librest · debian · 13
[librest-1.0-0]Affected
Source package: [librest]
Details (2)
- 0.9.1-6+b2 · amd64 · trixie
  Affected
  nvd · librest · debian · 13
- 0.9.1-6+b2 · arm64 · trixie
  Affected
  nvd · librest · debian · 13
[librest-dev]Affected
Source package: [librest]
Details (2)
- 0.9.1-6+b2 · amd64 · trixie
  Affected
  nvd · librest · debian · 13
- 0.9.1-6+b2 · arm64 · trixie
  Affected
  nvd · librest · debian · 13
[librest-doc]Affected
Source package: [librest]
Details (2)
- 0.9.1-6 · all · trixie
  Affected
  nvd · librest · debian · 13
- 0.9.1-6 · all · trixie
  Affected
  nvd · librest · debian · 13
[librest-extras-1.0-0]Affected
Source package: [librest]
Details (2)
- 0.9.1-6+b2 · amd64 · trixie
  Affected
  nvd · librest · debian · 13
- 0.9.1-6+b2 · arm64 · trixie
  Affected
  nvd · librest · debian · 13
[librest-extras-dev]Affected
Source package: [librest]
Details (2)
- 0.9.1-6+b2 · amd64 · trixie
  Affected
  nvd · librest · debian · 13
- 0.9.1-6+b2 · arm64 · trixie
  Affected
  nvd · librest · debian · 13

[openSUSE Tumbleweed]

[librest-1_0-0]Unknown
Source package: [librest]
Details (1)
- 0.10.2-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 0.10.2-2.1
  Version impact unknown
  nvd · librest · opensuse · tumbleweed
[librest-devel]Unknown
Source package: [librest]
Details (1)
- 0.10.2-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 0.10.2-2.1
  Version impact unknown
  nvd · librest · opensuse · tumbleweed
[typelib-1_0-Rest-1_0]Unknown
Source package: [librest]
Details (1)
- 0.10.2-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 0.10.2-2.1
  Version impact unknown
  nvd · librest · opensuse · tumbleweed

Observed: Oct 23, 2026, 9:43:35 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]