CVE-2026-65905

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65905
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-65905.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-65905
Aliases
Downstream
Published
2026-08-25T21:51:33Z
Modified
2026-09-10T09:41:00Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Tomcat: Limited replay attack possible with DIGEST authentication
Details

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window.

 

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-294"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65905.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "last_affected": "11.0.24"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "last_affected": "10.1.57"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "last_affected": "9.0.120"
                },
                {
                    "introduced": "8.5.0"
                },
                {
                    "last_affected": "8.5.100"
                },
                {
                    "introduced": "7.0.30"
                },
                {
                    "last_affected": "7.0.109"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "fixed": "11.0.24"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "fixed": "10.1.57"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "fixed": "9.0.120"
                },
                {
                    "introduced": "8.5.0"
                },
                {
                    "fixed": "8.5.100"
                },
                {
                    "introduced": "7.0.30"
                },
                {
                    "fixed": "7.0.109"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
86ecd2ad87b805992b9e4c2f2317feaab7a1e3fb
Last Affected
2cdef2c0241cdf70b5edd88d3733a52e6b675047
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.0.30"
        },
        {
            "last_affected": "7.0.109"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-65905.json"