CVE-2026-3099: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-3099 is an authentication bypass vulnerability in GNOME's Libsoup library, specifically in the server-side digest authentication implementation of the SoupAuthDomainDigest class. The flaw allows a remote attacker to capture a single valid HTTP digest authentication header and replay it indefinitely to bypass authentication and impersonate legitimate users. It affects GNOME Libsoup (all versions tracked under cpe:2.3:a:gnome:libsoup) and Red Hat Enterprise Linux versions 6.0 through 10.0. The vulnerability was reported on February 24, 2026, and published on March 12, 2026, with a CVSS v3.1 base score of 7.3 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-323 (Reusing a Nonce, Key Pair in Encryption). The vulnerability resides in libsoup/server/soup-auth-domain-digest.c, where the check_hex_urp function performs a purely mathematical hash verification without maintaining server-side state for issued nonces. Specifically, the code parses the nonce-count (nc) value and only checks that it is a positive integer — it never compares it against a previously seen value for the same nonce, allowing nc=00000001 to be reused indefinitely. Additionally, nonces are generated using time(0) and a message pointer address rather than a cryptographically secure method, and they are never expired by the server, creating an unlimited replay window. An unauthenticated remote attacker with the ability to intercept a single valid Authorization header (e.g., via network sniffing on an unencrypted channel) can exploit this to replay the captured credential without any further interaction (Red Hat Bugzilla, GNOME GitLab Issue).

Successful exploitation allows a remote, unauthenticated attacker to bypass HTTP digest authentication on any server using Libsoup's SoupAuthDomainDigest, gaining unauthorized access to protected resources while impersonating a legitimate user. The impact spans confidentiality (access to protected data), integrity (ability to perform actions as the victim user), and limited availability (LOW per CVSS scoring). Applications and services built on Libsoup — including GNOME-based desktop applications and server-side components on Red Hat Enterprise Linux — are at risk of unauthorized data access and session hijacking (Red Hat Advisory, Red Hat Bugzilla).

A reference to the issue is tracked in the GNOME GitLab issue tracker, which was listed as an exploit source by NVD as of March 23, 2026 (GNOME GitLab Issue). No weaponized exploit kit or confirmed in-the-wild exploitation has been reported. The EPSS score is approximately 0.105%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to first capture a valid digest authentication header, which typically requires a man-in-the-middle position or access to unencrypted traffic (Red Hat Advisory).

1. Reconnaissance: Identify services using Libsoup's digest authentication (e.g., GNOME-based HTTP servers or applications on RHEL) by scanning for HTTP servers that respond with WWW-Authenticate: Digest headers.
2. Capture valid authentication header: Position to intercept network traffic (e.g., via ARP spoofing, rogue Wi-Fi, or passive sniffing on an unencrypted network) and capture a legitimate user's Authorization: Digest HTTP request header, including the username, realm, nonce, uri, nc, cnonce, and response fields.
3. Replay the captured header: Craft an HTTP request to the protected resource, substituting the captured Authorization: Digest header verbatim (reusing nc=00000001 and the same nonce).
4. Bypass authentication: Because the server does not track issued nonces or enforce incrementing nc values, it recomputes the hash and accepts the replayed credential, granting access to the protected resource as the impersonated user (Red Hat Bugzilla, GNOME GitLab Issue).

• Network: Repeated HTTP requests to protected endpoints using identical Authorization: Digest headers (same nonce, nc=00000001, and response values) from different source IPs or at unusual times.
• Logs: HTTP server access logs showing multiple successful authenticated requests from the same or different IPs with identical nonce and nc values; absence of incrementing nc values across requests for the same session.
• Logs: Successful authentication events for a user account at times inconsistent with that user's normal activity patterns, potentially indicating session replay.
• Network: Unusual volume of authenticated requests to sensitive endpoints without corresponding login events or session initiation from the same client.

Users should apply patches provided by their Linux distribution vendor as soon as they become available; Red Hat has tracked this issue for RHEL 6, 7, 8, 9, and 10 (Red Hat Advisory). As a workaround, deploying TLS/HTTPS for all Libsoup-based services significantly reduces the risk by preventing passive interception of authentication headers. Additionally, consider replacing HTTP Digest authentication with stronger authentication mechanisms (e.g., token-based or mutual TLS authentication) where feasible. Monitor the Yocto Project security mailing list for embedded Linux patch availability (Yocto Security List).

The vulnerability was discussed in the Yocto Project security mailing list across multiple updates, reflecting concern from the embedded Linux community about patch availability (Yocto Security List). A security researcher (avleonov) included CVE-2026-3099 in a March 2026 Linux Patch Wednesday roundup, noting it as part of a broader set of libsoup flaws requiring attention (avleonov blog). Community aggregators such as VulnDB, CIRCL, and ENISA's EUVD have indexed the vulnerability, and it was noted on Bluesky by CVE tracking accounts shortly after publication.