Junglewise Threat Intelligence

CVE-2026-65905: Apache Tomcat DIGEST authenticator authentication bypass

CVE-2026-65905 · Severity: critical · CVSS 9.8 · Published 2026-08-26

Executive brief

Apache Tomcat is a widely-used web server that handles HTTP authentication for protecting web applications. This vulnerability affects Tomcat's DIGEST authentication mechanism, a scheme that protects passwords by not sending them in plaintext over the network. An attacker who captures a legitimate authentication request can replay it once within a specific time window to gain unauthorized access, bypassing the authentication system entirely. This affects multiple Tomcat versions across 7.0 through 11.0 release lines.

Technical details

The vulnerability exists in the DIGEST authenticator's replay protection mechanism, which uses a sliding window with a nonce counter (nonceCount) to prevent replay attacks. The bug occurs when a DIGEST authentication request carries a nonceCount value at the upper boundary of the replay window before windowSize requests have been made. Under these conditions, the vulnerable code fails to properly invalidate the request, allowing an attacker to replay the captured authentication payload once while that nonceCount value remains within the accepted replay window. The attack requires network access to intercept DIGEST authentication traffic but does not require privilege escalation, user interaction, or authentication. Patches are available in Tomcat 11.0.25, 10.1.58, and 9.0.121; versions 7.0 and 8.5 are end-of-life and no patches are available despite being known affected.

Affected products

  • Apache Tomcat 11.0.0-M1 through 11.0.24
  • Apache Tomcat 10.1.0-M1 through 10.1.57
  • Apache Tomcat 9.0.0.M1 through 9.0.120
  • Apache Tomcat 8.5.0 through 8.5.100
  • Apache Tomcat 7.0.30 through 7.0.109
  • Apache tomcat-embed-core 11.0.0-M1 through 11.0.24
  • Apache tomcat-embed-core 10.1.0-M1 through 10.1.57
  • Apache tomcat-embed-core 9.0.0.M1 through 9.0.120
  • Apache tomcat-embed-core 8.5.0 through 8.5.100
  • Apache tomcat-embed-core 7.0.30 through 7.0.109
  • Apache tomcat-catalina 11.0.0-M1 through 11.0.24
  • Apache tomcat-catalina 10.1.0-M1 through 10.1.57
  • Apache tomcat-catalina 9.0.0.M1 through 9.0.120
  • Apache tomcat-catalina 8.5.0 through 8.5.100
  • Apache tomcat-catalina 7.0.30 through 7.0.109

Timeline

  • 2026-08-26: disclosed: Published to GitHub Advisory Database
  • 2026-08-26: patched: Patches released: Tomcat 11.0.25, 10.1.58, 9.0.121

References

Related threats