CVE-2026-65905: Apache Tomcat: Limited replay attack possible with DIGEST authentication

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-25 · updated 2026-08-27
Weakness: CWE-294

Description

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Summary

Apache Tomcat's DIGEST authenticator has an authentication bypass via capture-replay: a request made with a nonceCount at the upper boundary of the replay window can be replayed once while that nonceCount stays within the window. This is rated critical (CVSS 9.8) and could let an attacker reuse captured credentials to bypass authentication. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120, plus EOL branches 8.5.0 through 8.5.100 and 7.0.30 through 7.0.109. No exploitation has been reported (not in CISA KEV, SSVC none, EPSS 0.6%). Upgrade to 11.0.25, 10.1.58, or 9.0.121.

تحتوي أداة المصادقة DIGEST في Apache Tomcat على ثغرة تجاوز للمصادقة عبر إعادة تشغيل الطلبات (capture-replay): يمكن إعادة تشغيل طلب يحمل nonceCount عند الحد الأعلى لنافذة إعادة التشغيل مرة واحدة فقط ما دام هذا nonceCount ضمن النافذة. صُنّفت الثغرة حرجة (CVSS 9.8) وقد تسمح للمهاجم بإعادة استخدام بيانات اعتماد ملتقطة لتجاوز المصادقة. تشمل الإصدارات المتأثرة Tomcat 11.0.0-M1 حتى 11.0.24، و10.1.0-M1 حتى 10.1.57، و9.0.0.M1 حتى 9.0.120، إضافة إلى الفرعين المنتهي دعمهما 8.5.0 حتى 8.5.100 و7.0.30 حتى 7.0.109. لم يُرصد أي استغلال فعلي (ليست في CISA KEV، وتقييم SSVC هو none، واحتمال EPSS 0.6%). يُنصح بالترقية إلى 11.0.25 أو 10.1.58 أو 9.0.121.

Affected products

Apache Tomcat: from 7.0.30 through 7.0.109; from 8.5.0 before 9.0.121; from 10.1.0 before 10.1.58; from 11.0.0 before 11.0.25 — fixed in 10.1.58, 11.0.25, 9.0.121

How to fix

Upgrade to a fixed version: Apache Tomcat 10.1.58, 11.0.25, 9.0.121. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-65905 or the next vulnerability affects your stack