Loading vulnerability…
Limited DIGEST Authentication Replay Bypass in Apache Tomcat
CVE-2026-65905 is an authentication-bypass vulnerability in Apache Tomcat's DIGEST authenticator caused by incorrect nonce-count replay-window handling. Before windowSize requests have been made, a DIGEST-authenticated request whose nonceCount is at the upper boundary of the replay window can be replayed once while that nonceCount remains within the window. Affected versions are 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. End-of-life versions 8.5.0 through 8.5.100 and 7.0.30 through 7.0.109 are also affected; other unsupported versions may be affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who captures a qualifying DIGEST-authenticated request can have that request accepted once more as authenticated, potentially obtaining unauthorized access to the resource or operation represented by the request. Exploitation is limited to one replay while the nonceCount remains within the replay window. Broader access, arbitrary request forgery, code execution, and denial of service are not established by this vulnerability's mechanism.
If you can’t patch tonight, do this now.
Until patched, restrict access to DIGEST-authenticated endpoints and enforce TLS to reduce opportunities to capture authenticated requests. Monitor for anomalous or duplicated authenticated requests. These measures reduce exposure or support detection but do not correct the replay-window flaw.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.25, 10.1.58, or 9.0.121 or a later supported release in the applicable branch. Migrate affected end-of-life 8.5 and 7.0 installations to a supported fixed release. For vendor-packaged or embedded Tomcat, apply the corresponding product security update. Identified fixed product releases include Confluence 9.2.26, 10.2.19, and 11.0.0, and Red Hat JBoss Web Server 6.2.5 and 7.0.2.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.