Critical Security Flaw in REST Package: Weak Random Number Generation in PKCE Implementation
Summary
RLSA-2026:47085: Important: rest security update. Affects rest versions < 0:0.9.1-11.el10_2.1. Fixed in 0:0.9.1-11.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'rest' package is a library designed for accessing RESTful web services, enabling developers to interact with APIs efficiently. It is widely used in various applications for its simplicity and effectiveness in handling web requests. However, a recent vulnerability has been identified that compromises the security of the PKCE (Proof Key for Code Exchange) implementation within this package, potentially exposing sensitive data.
Vulnerability Detail
The vulnerability, identified as CVE-2026-16615, stems from weak random number generation in the PKCE implementation of the 'rest' package. This weakness can allow attackers to predict the random values used in the authentication process, leading to unauthorized access and data breaches. The implications of this flaw are significant, as it can compromise user credentials and sensitive information, making it critical for developers to address this issue promptly.
How To Fix
Minimum fixed version
0:0.9.1-11.el10_2.1
This is the first release that contains the fix.
sudo dnf update restTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider implementing additional security layers, such as using alternative authentication methods or restricting access to sensitive endpoints until the vulnerability is resolved.
Conclusion
The vulnerability identified in the 'rest' package poses a significant security risk due to weak random number generation in its PKCE implementation. It is crucial for developers to update to the latest patched version to safeguard their applications against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for rest →
FAQ
CVE-2026-16615 is a security vulnerability in the 'rest' package that involves weak random number generation in the PKCE implementation, potentially allowing unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to user accounts and sensitive data breaches due to predictable random values in the authentication process.
Yes, a patched version of the 'rest' package is available. Users should update to version 0:0.9.1-11.el10_2.1 to mitigate the risk.
If immediate updates are not possible, consider implementing additional security measures or restricting access to sensitive areas of your application.
Related vulnerabilities
Recent vulnerabilities recorded for rest.
