CVE-2026-3099
Libsoup: libsoup: authentication bypass via digest authentication replay attack
CVE-2026-3099 is a medium vulnerability (CVSS 5.8) in Gnome Libsoup, published March 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in libsoup 2.62.2-2.0.13.el7.tuxcare.els2.
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Libsoup: libsoup: authentication bypass via digest authentication replay attack
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
- Record
CVE-2026-3099- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-323
- Updated
- 2026-11-02
EUVDEUVD-2026-11573
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
- Record
EUVD-2026-11573- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hrf3-6c7v-5628
A flaw was found in Libsoup. The server-side digest authentication implementation in the...
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
- Record
GHSA-hrf3-6c7v-5628- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-323
- Updated
- 2026-11-02
NVD
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
- Record
CVE-2026-3099- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-323
- Updated
- 2026-11-02
OSV
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
- Record
CVE-2026-3099- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-3099
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
- Record
DEBIAN-CVE-2026-3099- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 8 moreShow less
OSVROOT-OS-DEBIAN-12-CVE-2026-3099
CVE-2026-3099 in libsoup2.4 - Patched by Root
Root has patched CVE-2026-3099 in the libsoup2.4 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-3099- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-3099
CVE-2026-3099 in libsoup3 - Patched by Root
Root has patched CVE-2026-3099 in the libsoup3 package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-3099- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-3099
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
- Record
UBUNTU-CVE-2026-3099- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVAZL-80415 No score
CVE-2026-3099 affecting package libsoup 3.4.4-18
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
- Record
AZL-80415- Updated
- 2026-11-02
OSVCLSA-2026-1792464330 No score
libsoup: Fix of 4 CVEs
- CVE-2026-102557, CVE-2026-102559: cap WebSocket message reassembly and outgoing frames at the GByteArray size limit
- CVE-2026-102558: cap incoming WebSocket frame payloads at the receive buffer limit
- CVE-2026-102556: emit the WebSocket pong signal with a GBytes
- CVE-2026-3099: reject replayed and unissued nonces in SoupAuthDomainDigest
- Record
CLSA-2026-1792464330- Updated
- 2026-11-02
OSVCLSA-2026-1792464596 No score
libsoup: Fix of 4 CVEs
- CVE-2026-102557, CVE-2026-102559: cap WebSocket message reassembly and outgoing frames at the GByteArray size limit
- CVE-2026-102558: cap incoming WebSocket frame payloads at the receive buffer limit
- CVE-2026-102556: emit the WebSocket pong signal with a GBytes
- CVE-2026-3099: reject replayed and unissued nonces in SoupAuthDomainDigest
- Record
CLSA-2026-1792464596- Updated
- 2026-11-02
OSVCLSA-2026-1792514983 No score
libsoup: Fix of 4 CVEs
- CVE-2026-102557, CVE-2026-102559: cap WebSocket message reassembly and outgoing frames at the GByteArray size limit
- CVE-2026-102558: cap incoming WebSocket frame payloads at the receive buffer limit
- CVE-2026-102556: emit the WebSocket pong signal with a GBytes
- CVE-2026-3099: reject replayed and unissued nonces in SoupAuthDomainDigest
- Record
CLSA-2026-1792514983- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12365-1 No score
libsoup-3_0-0-3.8.1-1.1 on GA media
These are all security issues fixed in the libsoup-3_0-0-3.8.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12365-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsoupAzure Linux:3 |
through 3.4.4-18 | None known |
libsoupTuxCare:OracleLinux:7 |
before 2.62.2-2.0.13.el7.tuxcare.els2 | 2.62.2-2.0.13.el7.tuxcare.els2 |
libsoup-develTuxCare:OracleLinux:7 |
before 2.62.2-2.0.13.el7.tuxcare.els2 | 2.62.2-2.0.13.el7.tuxcare.els2 |
libsoupTuxCare:RHEL:7 |
before 2.62.2-2.0.13.el7.tuxcare.els2 | 2.62.2-2.0.13.el7.tuxcare.els2 |
libsoup-develTuxCare:RHEL:7 |
before 2.62.2-2.0.13.el7.tuxcare.els2 | 2.62.2-2.0.13.el7.tuxcare.els2 |
libsoupTuxCare:CentOS:7 |
before 2.62.2-2.0.13.el7.tuxcare.els2 | 2.62.2-2.0.13.el7.tuxcare.els2 |
libsoup-develTuxCare:CentOS:7 |
before 2.62.2-2.0.13.el7.tuxcare.els2 | 2.62.2-2.0.13.el7.tuxcare.els2 |
libsoup2.4Debian:12 |
All versions, plus listed versions 2.74.3-12.74.3-1+deb12u12.74.3-102.74.3-10.12.74.3-11 Show 11 moreShow less2.74.3-22.74.3-32.74.3-3.1~exp12.74.3-3.1~exp22.74.3-3.1~exp32.74.3-52.74.3-62.74.3-72.74.3-82.74.3-8.12.74.3-9 |
None known |
libsoup2.4Debian:13 |
All versions, plus listed versions 2.74.3-10.12.74.3-11 |
None known |
libsoup3Debian:12 |
All versions, plus listed versions 3.2.2-23.2.3-0+deb12u13.2.3-0+deb12u23.3.1-13.4.0-1 Show 33 moreShow less3.4.1-13.4.2-13.4.2-23.4.2-33.4.2-43.4.3-13.4.4-13.4.4-23.4.4-33.4.4-43.4.4-53.5.2-13.6.0-13.6.0-23.6.0-33.6.0-43.6.1-13.6.4-13.6.4-23.6.4-33.6.5-13.6.5-23.6.5-33.6.5-43.6.5-53.6.5-63.6.5-73.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3 |
None known |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libsoup3Debian:13 |
All versions, plus listed versions 3.6.5-33.6.5-43.6.5-53.6.5-63.6.5-7 Show 6 moreShow less3.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3 |
None known |
libsoup2.4Root:Debian:12 |
before 2.74.3-1+deb12u1.aikido.5 | 2.74.3-1+deb12u1.aikido.5 |
rootio-libsoup2.4Root:Debian:12 |
before 2.74.3-1+deb12u1.aikido.5 | 2.74.3-1+deb12u1.aikido.5 |
libsoup3Root:Debian:13 |
before 3.6.5-3.aikido.6 | 3.6.5-3.aikido.63.6.5-3.aikido.73.6.5-3.aikido.8 |
rootio-libsoup3Root:Debian:13 |
before 3.6.5-3.aikido.6 | 3.6.5-3.aikido.63.6.5-3.aikido.73.6.5-3.aikido.8 |
libsoup2.4Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.50.0-2debian12.52.1-12.52.2-12.52.2-1ubuntu0.12.52.2-1ubuntu0.2 Show 9 moreShow less2.52.2-1ubuntu0.32.52.2-1ubuntu0.3+esm12.52.2-1ubuntu0.3+esm22.52.2-1ubuntu0.3+esm32.52.2-1ubuntu0.3+esm42.52.2-1ubuntu0.3+esm52.52.2-1ubuntu0.3+esm62.52.2-1ubuntu0.3+esm72.52.2-1ubuntu0.3+esm8 |
None known |
libsoup2.4Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.60.1-12.60.2-12.60.2-22.60.3-12.61.90-1 Show 14 moreShow less2.62.0-12.62.1-12.62.1-1ubuntu0.12.62.1-1ubuntu0.32.62.1-1ubuntu0.42.62.1-1ubuntu0.4+esm12.62.1-1ubuntu0.4+esm22.62.1-1ubuntu0.4+esm32.62.1-1ubuntu0.4+esm42.62.1-1ubuntu0.4+esm52.62.1-1ubuntu0.4+esm62.62.1-1ubuntu0.4+esm72.62.1-1ubuntu0.4+esm82.62.1-1ubuntu0.4+esm9 |
None known |
libsoup2.4Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.68.2-0ubuntu12.68.2-12.68.2-22.68.2-2build22.69.90-1 Show 10 moreShow less2.70.0-12.70.0-1ubuntu0.12.70.0-1ubuntu0.22.70.0-1ubuntu0.32.70.0-1ubuntu0.42.70.0-1ubuntu0.52.70.0-1ubuntu0.5+esm12.70.0-1ubuntu0.5+esm22.70.0-1ubuntu0.5+esm32.70.0-1ubuntu0.5+esm4 |
None known |
libsoup2.4Ubuntu:22.04:LTS |
All versions, plus listed versions 2.72.0-3ubuntu32.74.1-12.74.2-22.74.2-32.74.2-3ubuntu0.1 Show 8 moreShow less2.74.2-3ubuntu0.22.74.2-3ubuntu0.32.74.2-3ubuntu0.42.74.2-3ubuntu0.52.74.2-3ubuntu0.62.74.2-3ubuntu0.72.74.2-3ubuntu0.82.74.2-3ubuntu0.9 |
None known |
libsoup3Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.0.4-23.0.4-33.0.5-13.0.7-0ubuntu13.0.7-0ubuntu1+esm1 Show 8 moreShow less3.0.7-0ubuntu1+esm23.0.7-0ubuntu1+esm33.0.7-0ubuntu1+esm43.0.7-0ubuntu1+esm53.0.7-0ubuntu1+esm63.0.7-0ubuntu1+esm73.0.7-0ubuntu1+esm83.0.7-0ubuntu1+esm9 |
None known |
libsoup2.4Ubuntu:24.04:LTS |
All versions, plus listed versions 2.74.3-12.74.3-22.74.3-32.74.3-62.74.3-6build1 Show 10 moreShow less2.74.3-6ubuntu12.74.3-6ubuntu1.12.74.3-6ubuntu1.22.74.3-6ubuntu1.32.74.3-6ubuntu1.42.74.3-6ubuntu1.52.74.3-6ubuntu1.62.74.3-6ubuntu1.72.74.3-6ubuntu1.82.74.3-6ubuntu1.9 |
None known |
libsoup3Ubuntu:24.04:LTS |
All versions, plus listed versions 3.4.2-43.4.4-13.4.4-23.4.4-43.4.4-5 Show 11 moreShow less3.4.4-5build13.4.4-5build23.4.4-5ubuntu0.13.4.4-5ubuntu0.23.4.4-5ubuntu0.33.4.4-5ubuntu0.43.4.4-5ubuntu0.53.4.4-5ubuntu0.63.4.4-5ubuntu0.73.4.4-5ubuntu0.83.4.4-5ubuntu0.9 |
None known |
libsoup2.4Ubuntu:25.10 |
All versions, plus listed versions 2.74.3-102.74.3-10.12.74.3-10.1ubuntu12.74.3-10.1ubuntu22.74.3-10.1ubuntu32.74.3-10.1ubuntu42.74.3-10.1ubuntu4.1 |
None known |
libsoup3Ubuntu:25.10 |
All versions, plus listed versions 3.6.5-13.6.5-1ubuntu13.6.5-33.6.5-43.6.5-4ubuntu0.13.6.5-4ubuntu0.2 |
None known |
libsoup2.4Ubuntu:26.10 |
All versions, plus listed versions 2.74.3-10.1ubuntu5 |
None known |
libsoup3Ubuntu:26.10 |
All versions, plus listed versions 3.6.6-13.6.6-1ubuntu3 |
None known |
libsoup3Ubuntu:26.04:LTS |
All versions, plus listed versions 3.6.5-43.6.5-53.6.5-63.6.5-73.6.5-93.6.6-13.6.6-1ubuntu0.1 |
None known |
libsoup2.4Ubuntu:Pro:26.04:LTS |
All versions, plus listed versions 2.74.3-10.1ubuntu42.74.3-10.1ubuntu52.74.3-10.1ubuntu5+esm12.74.3-10.1ubuntu5+esm22.74.3-10.1ubuntu5+esm3 |
None known |
libsoupopenSUSE:Tumbleweed |
before 3.8.1-1.1 | 3.8.1-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
access.redhat.com/security/cve/CVE-2026-3099
bugzilla.redhat.com/show_bug.cgi?id=2442232
gitlab.gnome.org/GNOME/libsoup/-/issues/495
nvd.nist.gov/vuln/detail/CVE-2026-3099
github.com/advisories/GHSA-hrf3-6c7v-5628
errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792464330.html
Show 19 moreShow less
security-tracker.debian.org/tracker/CVE-2026-3099
ubuntu.com/security/CVE-2026-3099
cve.org/CVERecord?id=CVE-2026-3099
suse.com/security/cve/CVE-2026-12547