CVE-2026-3099: gnome libsoup Reusing a Nonce, Key Pair in Encryption
Vulnerability summary
CVE-2026-3099 is a high (CVSS 7.3) Reusing a Nonce, Key Pair in Encryption vulnerability in gnome libsoup. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 12-03-2026PublishedVulnerability first disclosed.
- 01-05-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA5.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
+0.15 pp
From 0.36% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- libsoup2.4All versions (No fix recorded)
- libsoup3All versions (No fix recorded) | < 3.8.0-1
Ubuntu2 products
- libsoup2.4All versions (No fix recorded)
- libsoup3All versions (No fix recorded)
Gnome1 product
- libsoupna
Redhat1 product
- enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0 | 10.0
4 vendors · 6 products
