Apache Tomcat: Limited replay attack possible with DIGEST authentication (CVE-2026-65905)

CVE-2026-65905 is an authentication bypass vulnerability in Apache Tomcat's DIGEST authenticator. The flaw allows a limited capture-replay attack where a DIGEST authenticated request with a nonceCount at the upper boundary of the replay window can be replayed once while the nonceCount remains within the replay window. This affects Apache Tomcat versions from 7.0.30 through 9.0.120, 10.1.0 through 10.1.57, and 11.0.0 through 11.0.24, including some end-of-life versions such as 8.5.0 through 8.5.100 and 7.0.30 through 7.0.109. The vulnerability is addressed by upgrading to versions 11.0.25, 10.1.58, or 9.0.121.

The vulnerability allows an attacker to replay a DIGEST authenticated request once under specific conditions, potentially bypassing authentication controls temporarily. This could lead to unauthorized actions being performed if the replayed request grants access or performs sensitive operations. However, the replay is limited to a single reuse within the replay window defined by the nonceCount, reducing the scope of exploitation.

A fix is available. Users should upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121 or later to remediate this vulnerability. No additional mitigations are indicated beyond applying the official patch.