CVE-2026-65905: Apache Tomcat DIGEST authenticator authentication bypass

CVE-2026-65905 · Severity: critical · CVSS 9.8 · Published 2026-08-25

Apache Tomcat is a widely-used web server that handles HTTP authentication for protecting web applications. This vulnerability affects Tomcat's DIGEST authentication mechanism, a scheme that protects passwords by not sending them in plaintext over the network. An attacker who captures a legitimate authentication request can replay it once within a specific time window to gain unauthorized access, bypassing the authentication system entirely. This affects multiple Tomcat versions across 7.0 through 11.0 release lines.

Technologies: Apache Tomcat, Apache Tomcat-Embed-Core, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-65905 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-65905 being exploited in the wild.
How severe is CVE-2026-65905?
Critical severity, with a CVSS score of 9.8, published 25 August 2026.
Which products and versions are affected?
Apache Tomcat 11.0.0-M1 through 11.0.24; Apache Tomcat-Embed-Core 11.0.0-M1 through 11.0.24; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.25; org.apache.tomcat:tomcat-catalina (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.25; and 1 more.
Is there a fix for CVE-2026-65905?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 11.0.25 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.25 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65905 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-65905?
Check whether you run Apache Tomcat, Apache Tomcat-Embed-Core, org.apache.tomcat:tomcat (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 11.0.25 or later
    # set org.apache.tomcat:tomcat to 11.0.25 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.25 or later
    # set org.apache.tomcat:tomcat-catalina to 11.0.25 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.25 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 11.0.25 in your pom.xml or build.gradle

Technical details

The vulnerability exists in the DIGEST authenticator's replay protection mechanism, which uses a sliding window with a nonce counter (nonceCount) to prevent replay attacks. The bug occurs when a DIGEST authentication request carries a nonceCount value at the upper boundary of the replay window before windowSize requests have been made. Under these conditions, the vulnerable code fails to properly invalidate the request, allowing an attacker to replay the captured authentication payload once while that nonceCount value remains within the accepted replay window. The attack requires network access to intercept DIGEST authentication traffic but does not require privilege escalation, user interaction, or authentication. Patches are available in Tomcat 11.0.25, 10.1.58, and 9.0.121; versions 7.0 and 8.5 are end-of-life and no patches are available despite being known affected.

Affected products

  • Apache Tomcat 11.0.0-M1 through 11.0.24
  • Apache Tomcat 10.1.0-M1 through 10.1.57
  • Apache Tomcat 9.0.0.M1 through 9.0.120
  • Apache Tomcat 8.5.0 through 8.5.100
  • Apache Tomcat 7.0.30 through 7.0.109
  • Apache tomcat-embed-core 11.0.0-M1 through 11.0.24
  • Apache tomcat-embed-core 10.1.0-M1 through 10.1.57
  • Apache tomcat-embed-core 9.0.0.M1 through 9.0.120
  • Apache tomcat-embed-core 8.5.0 through 8.5.100
  • Apache tomcat-embed-core 7.0.30 through 7.0.109
  • Apache tomcat-catalina 11.0.0-M1 through 11.0.24
  • Apache tomcat-catalina 10.1.0-M1 through 10.1.57
  • Apache tomcat-catalina 9.0.0.M1 through 9.0.120
  • Apache tomcat-catalina 8.5.0 through 8.5.100
  • Apache tomcat-catalina 7.0.30 through 7.0.109

Identifiers

  • CVE-2026-65905
  • GHSA-9xv2-5v5q-p794

Timeline

  • 2026-08-26: disclosed: Published to GitHub Advisory Database
  • 2026-08-26: patched: Patches released: Tomcat 11.0.25, 10.1.58, 9.0.121

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.