CVE-2026-65905PATCHED

apache · tomcat

Apache Tomcat: Limited replay attack possible with DIGEST authentication

Description

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Affected Products

Vendor	Product	Versions
apache	tomcat	maven/org.apache.tomcat:tomcat: >= 11.0.0-M1, < 11.0.25, maven/org.apache.tomcat:tomcat: >= 10.1.0-M1, < 10.1.58, maven/org.apache.tomcat:tomcat: >= 9.0.0.M1, < 9.0.121, maven/org.apache.tomcat:tomcat: >= 8.5.0, <= 8.5.100, maven/org.apache.tomcat:tomcat: >= 7.0.30, <= 7.0.109, maven/org.apache.tomcat.embed:tomcat-embed-core: >= 11.0.0-M1, < 11.0.25, maven/org.apache.tomcat.embed:tomcat-embed-core: >= 10.1.0-M1, < 10.1.58, maven/org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.0.M1, < 9.0.121, maven/org.apache.tomcat.embed:tomcat-embed-core: >= 8.5.0, <= 8.5.100, maven/org.apache.tomcat.embed:tomcat-embed-core: >= 7.0.30, <= 7.0.109, maven/org.apache.tomcat:tomcat-catalina: >= 11.0.0-M1, < 11.0.25, maven/org.apache.tomcat:tomcat-catalina: >= 10.1.0-M1, < 10.1.58, maven/org.apache.tomcat:tomcat-catalina: >= 9.0.0.M1, < 9.0.121, maven/org.apache.tomcat:tomcat-catalina: >= 8.5.0, <= 8.5.100, maven/org.apache.tomcat:tomcat-catalina: >= 7.0.30, <= 7.0.109

Also Affects

Downstream vendors/products affected by this vulnerability

Vendor	Product	Source	Confidence
apache	tomcat	cert_advisory	90%
ibm	qradar siem	cert_advisory	90%
maven	org.apache.tomcat:tomcat	GHSA	85%
maven	org.apache.tomcat.embed:tomcat-embed-core	GHSA	85%
maven	org.apache.tomcat:tomcat-catalina	GHSA	85%

References

https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj(vendor-advisory)

Related News (8 articles)

Tier B

CERT-FR13d ago

Multiples vulnérabilités dans les produits IBM (02 octobre 2026)

→ No new info (linked only)

Tier B

CERT-FR13d ago

Multiples vulnérabilités dans les produits VMware (02 octobre 2026)

→ No new info (linked only)

Tier B

BSI Advisories17d ago

[NEU] [hoch] IBM QRadar SIEM: Mehrere Schwachstellen

→ No new info (linked only)

Tier B

CERT-FR34d ago

Multiples vulnérabilités dans les produits IBM (11 septembre 2026)

→ No new info (linked only)

Tier B

BSI Advisories50d ago

[NEU] [hoch] Apache Tomcat: Mehrere Schwachstellen

→ No new info (linked only)

Tier C

oss-security50d ago

CVE-2026-65905: Apache Tomcat: Limited replay attack possible with DIGEST authentication

→ No new info (linked only)

Tier B

CERT-FR50d ago

Multiples vulnérabilités dans Apache Tomcat (26 août 2026)

→ No new info (linked only)

Tier C

VulDB51d ago

CVE-2026-65905 | Apache Tomcat up to 11.0.24 DIGEST Authenticator authentication replay

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.19.8 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

org.apache.tomcat:tomcat@11.0.25org.apache.tomcat:tomcat@10.1.58org.apache.tomcat:tomcat@9.0.121org.apache.tomcat.embed:tomcat-embed-core@11.0.25org.apache.tomcat.embed:tomcat-embed-core@10.1.58org.apache.tomcat.embed:tomcat-embed-core@9.0.121org.apache.tomcat:tomcat-catalina@11.0.25org.apache.tomcat:tomcat-catalina@10.1.58org.apache.tomcat:tomcat-catalina@9.0.121

CWECWE-294

PublishedAug 25, 2026

Trending Score15

Source articles8

Independent4

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

NONECVE-2026-82617

Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

Trending: 39

CRITICALCVE-2026-59797

Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

Trending: 31

CRITICALCVE-2026-56154

Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

Trending: 31

CRITICALCVE-2026-57941

Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

Trending: 31

CRITICALCVE-2026-65182

Apache Tomcat: Bypass longest prefix security constraint

Trending: 15

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Aug 25, 2026

Discovered by ZDM

Aug 25, 2026

Patch Available

Aug 26, 2026

Description

Vendor

Product

Versions

apache

tomcat

maven/org.apache.tomcat:tomcat: >= 11.0.0-M1, < 11.0.25, maven/org.apache.tomcat:tomcat: >= 10.1.0-M1, < 10.1.58, maven/org.apache.tomcat:tomcat: >= 9.0.0.M1, < 9.0.121, maven/org.apache.tomcat:tomcat: >= 8.5.0, <= 8.5.100, maven/org.apache.tomcat:tomcat: >= 7.0.30, <= 7.0.109, maven/org.apache.tomcat.embed:tomcat-embed-core: >= 11.0.0-M1, < 11.0.25, maven/org.apache.tomcat.embed:tomcat-embed-core: >= 10.1.0-M1, < 10.1.58, maven/org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.0.M1, < 9.0.121, maven/org.apache.tomcat.embed:tomcat-embed-core: >= 8.5.0, <= 8.5.100, maven/org.apache.tomcat.embed:tomcat-embed-core: >= 7.0.30, <= 7.0.109, maven/org.apache.tomcat:tomcat-catalina: >= 11.0.0-M1, < 11.0.25, maven/org.apache.tomcat:tomcat-catalina: >= 10.1.0-M1, < 10.1.58, maven/org.apache.tomcat:tomcat-catalina: >= 9.0.0.M1, < 9.0.121, maven/org.apache.tomcat:tomcat-catalina: >= 8.5.0, <= 8.5.100, maven/org.apache.tomcat:tomcat-catalina: >= 7.0.30, <= 7.0.109

Vendor

Product

Source

Confidence

apache

tomcat

cert_advisory

90%

ibm

qradar siem

cert_advisory

90%

maven

org.apache.tomcat:tomcat

GHSA

85%

maven

org.apache.tomcat.embed:tomcat-embed-core

GHSA

85%

maven

org.apache.tomcat:tomcat-catalina

GHSA

85%