CVE-2026-3099: Libsoup: güvenlik açığı

Açıklama (NVD)

A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.

Özet bilgiler

Ürün

Gnome Libsoup

CVSS v3.1

7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

%0,37 (yüzdelik 31)

CWE

CWE-323

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• access.redhat.com
• bugzilla.redhat.com
• gitlab.gnome.org
• CWE-323