CVE-2026-16615: fallo de gravedad media en GNOME librest
Librest: weak random number generation in pkce implementation
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear Red Hat Enterprise Linux+ Monitorear Red Hat Enterprise Linux 10.0 Extended Update Support
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.8epss 0.4%
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Productos afectados
GNOME · librestRed Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 10.0 Extended Update SupportCVEs relacionadas — GNOME librest
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-3094CRITICALXz: malicious code in distributed sourceEPSS 90.9%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.5%CVE-2025-10230CRITICALSamba: command injection in wins server hook scriptEPSS 39.8%CVE-2025-26466MEDIUMOpenssh: denial-of-service in opensshEPSS 38.7%CVE-2024-6409HIGHOpenssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9EPSS 27.9%