GNOME 51.1 Released: First Bugfix Drop for the A Coruña Desktop
With security patches and a long-delayed drag-and-drop fix, GNOME's newest maintenance update is more worth installing than the "boring" label admits.
GNOME 51.1 landed today as the first point release for the GNOME 51 desktop series. Codenamed "A Coruña," the mainline shipped back on September 16 after roughly six months of development. The Release Team was not shy about setting expectations.
"This is a stable bugfix release for GNOME 51," it wrote on the GNOME Discourse. "GNOME 51.1 is designed to be a boring bugfix update... so it should be a safe and uneventful upgrade."
Boring is a feature when it means your desktop stops breaking. But this release quietly carries more than its weight, mostly because of the security work tucked into a networking library that a lot of GNOME apps lean on.
The security work is the real reason
Here is the part worth your attention. GNOME 51.1 moves Libsoup, the HTTP client and server library that powers the networking behind many GNOME applications, from 3.7.3 up to the new 3.8.0 branch. That jump closes several genuine holes.
The most glaring is CVE-2026-3099. SoupAuthDomainDigest's server-side digest authentication did not properly track issued nonces or enforce the incrementing nonce-count attribute. In plain terms, an attacker who grabbed a single valid auth header could replay it over and over to impersonate users. It is a medium-severity issue at CVSS 5.8, but credential replay is exactly the kind of flaw that gets people locked out of their own systems.
Then there is CVE-2026-66337, a medium-severity heap buffer over-read (CVSS 6.5) triggered by an unsigned integer underflow when parsing multipart HTTP responses. A malicious server could crash the client or leak fragments of heap memory. YesWeHack took the report, and a researcher going by "cavid" was credited, with backing from the Sovereign Tech Agency's Resilience program. It is a small detail, but responsible-disclosure names are the kind of thing you only catch if you actually read the advisories.
On top of those, Libsoup 3.8 hardens SoupServer against HTTP request smuggling. The server now closes the connection after an early response to Expect: 100-continue, rejects Host headers that carry URI delimiters, and requires chunk sizes to start with a hex digit. There is also a change that stops cached proxy credentials from being forwarded after a redirect to a different origin. That quietly defeats a class of attacks where a destination server sniffs your proxy auth header.
The Epiphany browser gets its own patch here as well, CVE-2026-94291, which let an insecure iframe through the view-source and ephy-reader schemes. Michael Catanzaro handled the fix. Small and precise, but browser sandbox holes are the sort of thing you do not want to leave to luck.
This is not the first time libsoup has needed hardening in 2026 either. Several WebSocket and multipart advisories were already drifting through security trackers earlier this year, so the library has been on the radar for a while. Because Libsoup is shared so widely, these fixes matter beyond any single browser. Once your distro packages 51.1, effectively every GNOME app that reaches across the network benefits.
The changes you'll actually notice
If security is the reason to upgrade, the headline you will truly see is in Mutter. GNOME 51.1 fixes drag-and-drop between native Wayland clients and X11 applications running under Xwayland. Shifting a file out of a modern app and into an older X11 window no longer silently fails. It is the kind of long-standing wart power users have just learned to live with.
Mutter picked up other stuff too, like honoring a monitor reassignment after a configure event, preserving most-recently-used window order when windows go sticky, and throttling frame-clock updates in power-saving mode. That last one is a tiny efficiency win that only matters if you actually chase battery life on a laptop.
GNOME Shell gets a web-login and banner layout tidy-up, a fix for lock-screen clock positioning, and a correction for Quick Settings that could block direct scanout, a soft source of tearing. Several memory leaks were plugged along the way.
Nautilus, the file manager, took its usual scatter of refinements. Tabs now reuse themselves when opened from the shell, the Replace button is focused by default in the conflict dialog, and thumbnail sizing in the Properties window was finally coaxed into a proper square. Nothing that changes how you work. Just fewer reasons to raise an eyebrow.
The accessibility suite deserves a mention. Orca, the screen reader, got better handling for tables and grids where selection does not follow focus, plus support for the GPaste3 D-Bus interface. Tiny changes, but meaningful for the people who depend on it most.
Roughly 30 modules got version bumps overall, including glib, gtk, librsvg, and evolution-data-server. The rest of the stack was intentionally left alone, gnome-software, gdm, and libadwaita among the modules that stayed put. An unchanged version number does not mean a module is broken. Maintainers only ship a new release when they think it is warranted, so a module sitting at 51.0 simply means nobody found something worth shipping yet.
What comes next
GNOME's cadence has been predictable since version 40: two major releases a year, roughly in September and March, with point releases like this one landing in between to fix bugs and security issues without adding features. You could even call this an old-stable situation, since GNOME 50.6, the maintenance drop for the previous series, was delivered the same week.
Ubuntu 26.10, shipping October 15, already adopts GNOME 51 as its default desktop. That is probably why you are hearing about this now rather than from a terse security advisory. Most of these packages reach users through their distro's repositories, not directly from GNOME.
The GNOME 51 line will get five more point releases before it ages out. 51.2 lands November 21, and the next major version, 52.0, targets March 17, 2027. The entire 52 series enters unstable development on January 9. If you are still on the older 50 series, that timeline is a real nudge to move: 50.10 will be its final release in March 2027.
To check what you are running, drop into a terminal and type gnome-shell --version, or open Settings and glance at the About page. If you are already on 51, a normal system update should pull in 51.1 once your distro has packaged it. Arch Linux had a gnome-shell 51.1 package built back on October 14, and Ubuntu users will get it through the usual channels. Developers who want to compile from source can grab the BuildStream snapshot, gnome-build-meta-51.1.tar.xz, from the GNOME project pages.
Head here for the full list of changed modules.
