NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Maven

CVE-2026-65905: Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

criticalCVSS 3.1 9.8GHSA-9xv2-5v5q-p794

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window.

Published Aug 26, 2026 · Updated Sep 2, 2026

Affected packages

org.apache.tomcat:tomcat

Ecosystem
Maven
Affected
>= 11.0.0-M1, < 11.0.25
Fixed in
11.0.25
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat

Ecosystem
Maven
Affected
>= 10.1.0-M1, < 10.1.58
Fixed in
10.1.58
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat

Ecosystem
Maven
Affected
>= 9.0.0.M1, < 9.0.121
Fixed in
9.0.121
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat

Ecosystem
Maven
Affected
>= 8.5.0, <= 8.5.100
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat

Ecosystem
Maven
Affected
>= 7.0.30, <= 7.0.109
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat.embed:tomcat-embed-core

Ecosystem
Maven
Affected
>= 11.0.0-M1, < 11.0.25
Fixed in
11.0.25
Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

org.apache.tomcat.embed:tomcat-embed-core

Ecosystem
Maven
Affected
>= 10.1.0-M1, < 10.1.58
Fixed in
10.1.58
Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

org.apache.tomcat.embed:tomcat-embed-core

Ecosystem
Maven
Affected
>= 9.0.0.M1, < 9.0.121
Fixed in
9.0.121
Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

org.apache.tomcat.embed:tomcat-embed-core

Ecosystem
Maven
Affected
>= 8.5.0, <= 8.5.100
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

org.apache.tomcat.embed:tomcat-embed-core

Ecosystem
Maven
Affected
>= 7.0.30, <= 7.0.109
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 11.0.0-M1, < 11.0.25
Fixed in
11.0.25
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 10.1.0-M1, < 10.1.58
Fixed in
10.1.58
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 9.0.0.M1, < 9.0.121
Fixed in
9.0.121
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 8.5.0, <= 8.5.100
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 7.0.30, <= 7.0.109
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Credited to oscerd.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Maven vulnerabilities

All Maven entries