Security readout for executives and security teams
Plain-English summary
A flaw in the libsoup HTTP library lets an attacker who captures one valid login response replay it to impersonate the user. The server fails to track one-time login values that should change with each request. Risk is moderate: it requires intercepting traffic and a user action, and most current Red Hat Linux versions are listed as unaffected.
Executive priority
Schedule patching during normal maintenance once vendor fixes ship. Prioritize hosts running libsoup-based services that expose digest-protected resources to untrusted networks.
Technical view
SoupAuthDomainDigest in libsoup does not persist issued server nonces or validate the client's incrementing nonce-count (nc) value, breaking RFC-mandated digest replay protection. A network-positioned attacker who captures a single valid digest Authorization header can replay it to authenticate as the legitimate user. CVSS 3.1 5.8 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L). CWE-323: reusing a nonce/key with encryption.
Likely exposure
Exposure is limited to environments running services that use libsoup's server-side digest authentication (SoupAuthDomainDigest). Per Red Hat's affected list, RHEL 7, 8, 9, and 10 (libsoup3) are marked unaffected, while RHEL 6 status is unknown. GNOME/desktop or embedded Linux apps embedding libsoup HTTP servers are the most likely real-world surface.
Exploitation context
No public exploitation, KEV listing, or proof-of-concept is referenced in the bundle. CVSS notes high attack complexity and required user interaction, plus a captured valid digest header, which limits practical attack scenarios. Risk concentrates where libsoup-based servers expose digest-protected endpoints over untrusted networks.
Researcher notes
Root cause is CWE-323 (reusing a nonce/key in encryption). SoupAuthDomainDigest does not record issued nonces or validate the incrementing nc (nonce-count) attribute required by RFC 7616/2617, so a captured Authorization header replays cleanly. Impact is limited to apps using libsoup's server-side digest auth; client-side use is not in scope. Watch GNOME/libsoup MR linked from issue #495 for the upstream patch and test by replaying a captured digest header against a fixed build to confirm rejection.
Mitigation direction
- Track the GNOME libsoup issue and apply upstream fixes once released by your distribution.
- Prefer TLS plus stronger auth (mutual TLS, OAuth, or session tokens) over HTTP digest where feasible.
- Restrict libsoup digest-protected endpoints to trusted networks or VPN until patched.
- Monitor vendor advisories from Red Hat, GNOME, and downstream distros for libsoup updates.
- Inventory applications and appliances that embed libsoup as an HTTP server.
Validation and detection
- Identify hosts and apps shipping libsoup or libsoup3 packages and note version.
- Determine which apps use SoupAuthDomainDigest server-side authentication.
- Cross-reference Red Hat affected status; treat RHEL 6 as unknown until confirmed.
- After patching, verify replayed digest headers are rejected by the updated server.
- Review HTTP logs for repeated identical Authorization digest headers from differing sources.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-323: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-3099 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L1.63.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.8MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://access.redhat.com/security/cve/CVE-2026-3099CVE reference · vdb-entry, x_refsource_REDHAT
- RHBZ#2442232CVE reference · issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/495CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Reusing a Nonce, Key Pair in Encryption
Reusing a Nonce, Key Pair in Encryption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.