Vulnerability · Published Mar 12, 2026 · Assigned by redhat
CVE-2026-3099Libsoup: libsoup: authentication bypass via digest authentication replay attack
Medium 5.8
In plain English
A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libsoup2.4 | no fix listed | DEBIAN-CVE-2026-3099 |
| Debian:13 | libsoup2.4 | no fix listed | DEBIAN-CVE-2026-3099 |
| Debian:12 | libsoup3 | no fix listed | DEBIAN-CVE-2026-3099 |
| Debian:13 | libsoup3 | no fix listed | DEBIAN-CVE-2026-3099 |
| Ubuntu:22.04:LTS | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-3099 |
| Ubuntu:24.04:LTS | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-3099 |
| Ubuntu:25.10 | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-3099 |
| Ubuntu:26.10 | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-3099 |
| Ubuntu:24.04:LTS | libsoup3 | no fix listed | UBUNTU-CVE-2026-3099 |
| Ubuntu:25.10 | libsoup3 | no fix listed | UBUNTU-CVE-2026-3099 |
| Ubuntu:26.04:LTS | libsoup3 | no fix listed | UBUNTU-CVE-2026-3099 |
| Ubuntu:26.10 | libsoup3 | no fix listed | UBUNTU-CVE-2026-3099 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-323 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
References
- https://access.redhat.com/security/cve/CVE-2026-3099 vdb-entry, x_refsource_REDHAT
- RHBZ#2442232 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/495