{
  "cveId": "CVE-2026-16615",
  "url": "https://patchblox.com/security/cve/CVE-2026-16615",
  "summary": "CVE-2026-16615 is fixed in 8 products on 1 platform, first by RHSA-2026:62222, released June 8, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Librest: weak random number generation in pkce implementation",
  "description": "A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated \u0022code verifier\u0022 lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.",
  "published": "2026-06-08T00:00:00Z",
  "severity": "Moderate",
  "cvss": 6.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
  "cwe": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
  "epss": 0.00435,
  "epssPercentile": 0.38042,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-16615",
  "fixes": [
    {
      "platform": "linux",
      "product": "librest",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.9.1-160000.3.1",
      "fix": "OPENSUSE-SU-2026:21694-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21694-1",
      "released": "2026-08-30T14:33:19Z"
    },
    {
      "platform": "linux",
      "product": "librest",
      "release": "sles 15.7",
      "fixedVersion": "0.9.1-150600.3.3.1",
      "fix": "SUSE-SU-2026:3795-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3795-1",
      "released": "2026-08-25T12:38:20Z"
    },
    {
      "platform": "linux",
      "product": "librest",
      "release": "sles 16.0",
      "fixedVersion": "0.9.1-160000.3.1",
      "fix": "SUSE-SU-2026:23564-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23564-1",
      "released": "2026-08-30T14:34:16Z"
    },
    {
      "platform": "linux",
      "product": "librest0_7",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.8.1-bp160.2.1",
      "fix": "OPENSUSE-SU-2026:21563-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21563-1",
      "released": "2026-08-11T17:02:11Z"
    },
    {
      "platform": "linux",
      "product": "librest0_7",
      "release": "sles 15.7",
      "fixedVersion": "0.8.1-150600.4.3.1",
      "fix": "SUSE-SU-2026:3834-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3834-1",
      "released": "2026-08-27T11:35:33Z"
    },
    {
      "platform": "linux",
      "product": "rest",
      "release": "Fedora 43",
      "fixedVersion": "0.10.2-5.fc43",
      "fix": "FEDORA-2026-C2116E108F",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-c2116e108f",
      "released": "2026-08-26T01:52:35Z"
    },
    {
      "platform": "linux",
      "product": "rest",
      "release": "RHEL 10",
      "fixedVersion": "0.9.1-11.el10_0.1",
      "fix": "RHSA-2026:62222",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-62222",
      "released": "2026-06-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rest",
      "release": "almalinux 10",
      "fixedVersion": "0.9.1-11.el10_2.1",
      "fix": "ALSA-2026:47085",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-47085",
      "released": "2026-07-28T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rest",
      "release": "ol 10",
      "fixedVersion": "0:0.9.1-11.el10_2.1",
      "fix": "ELSA-2026-47085",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-47085",
      "released": "2026-07-28T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rest",
      "release": "rocky 10",
      "fixedVersion": "0:0.9.1-11.el10_2.1",
      "fix": "RLSA-2026:47085",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-47085",
      "released": "2026-07-29T18:06:20Z"
    },
    {
      "platform": "linux",
      "product": "rest-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "0.10.2-5.fc43",
      "fix": "FEDORA-2026-C2116E108F",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-c2116e108f",
      "released": "2026-08-26T01:52:35Z"
    },
    {
      "platform": "linux",
      "product": "rest-debugsource",
      "release": "Fedora 43",
      "fixedVersion": "0.10.2-5.fc43",
      "fix": "FEDORA-2026-C2116E108F",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-c2116e108f",
      "released": "2026-08-26T01:52:35Z"
    },
    {
      "platform": "linux",
      "product": "rest-demo",
      "release": "Fedora 43",
      "fixedVersion": "0.10.2-5.fc43",
      "fix": "FEDORA-2026-C2116E108F",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-c2116e108f",
      "released": "2026-08-26T01:52:35Z"
    },
    {
      "platform": "linux",
      "product": "rest-demo-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "0.10.2-5.fc43",
      "fix": "FEDORA-2026-C2116E108F",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-c2116e108f",
      "released": "2026-08-26T01:52:35Z"
    },
    {
      "platform": "linux",
      "product": "rest-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.10.2-5.fc43",
      "fix": "FEDORA-2026-C2116E108F",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-c2116e108f",
      "released": "2026-08-26T01:52:35Z"
    },
    {
      "platform": "linux",
      "product": "rest-devel",
      "release": "almalinux 10",
      "fixedVersion": "0.9.1-11.el10_2.1",
      "fix": "ALSA-2026:47085",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-47085",
      "released": "2026-07-28T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rest-devel",
      "release": "ol 10",
      "fixedVersion": "0:0.9.1-11.el10_2.1",
      "fix": "ELSA-2026-47085",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-47085",
      "released": "2026-07-28T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}