OESA-2026-3976

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3976

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-3976.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-3976

Upstream

CVE-2026-16615

Published

2026-09-20T13:23:44Z

Modified

2026-09-20T13:30:29Z

Severity

6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

rest security update

Details

This library has been designed to make it easier to access web services that claim to be "RESTful". It comprises of two parts: the first aims to make it easier to make requests by providing a wrapper around libsoup, the second aids with XML parsing by wrapping libxml2.

Security Fix(es):

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.(CVE-2026-16615)

Database specific

{
    "severity":  "Medium"
}

References

Affected packages

openEuler:24.03-LTS-SP4 / rest

Package

Name: rest
Purl: pkg:rpm/openEuler/rest&distro=openEuler-24.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.9.1-6.oe2403sp4

Ecosystem specific

{
    "aarch64":  [
        "rest-0.9.1-6.oe2403sp4.aarch64.rpm",
        "rest-debuginfo-0.9.1-6.oe2403sp4.aarch64.rpm",
        "rest-debugsource-0.9.1-6.oe2403sp4.aarch64.rpm",
        "rest-demo-0.9.1-6.oe2403sp4.aarch64.rpm",
        "rest-devel-0.9.1-6.oe2403sp4.aarch64.rpm"
    ],
    "noarch":  [
        "rest-help-0.9.1-6.oe2403sp4.noarch.rpm"
    ],
    "src":  [
        "rest-0.9.1-6.oe2403sp4.src.rpm"
    ],
    "x86_64":  [
        "rest-0.9.1-6.oe2403sp4.x86_64.rpm",
        "rest-debuginfo-0.9.1-6.oe2403sp4.x86_64.rpm",
        "rest-debugsource-0.9.1-6.oe2403sp4.x86_64.rpm",
        "rest-demo-0.9.1-6.oe2403sp4.x86_64.rpm",
        "rest-devel-0.9.1-6.oe2403sp4.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-3976.json"