Maven/org.apache.tomcat:tomcat CVE-2026-65905: critical 9.8, EPSS 0.56%
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
Action: Upgrade org.apache.tomcat:tomcat to 9.0.121 (9.x), 10.1.58 (10.x) or 11.0.25 (11.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.0.0-M1 | 11.0.25 | - |
| 10.1.0-M1 | 10.1.58 | - |
| 9.0.0.M1 | 9.0.121 | - |
| 8.5.0 | - | 8.5.100 |
| 7.0.30 | - | 7.0.109 |
Fixed versions
| 11.0.25 | 10.1.58 | 9.0.121 |
Sources
- osv: GHSA-9xv2-5v5q-p794
- https://nvd.nist.gov/vuln/detail/CVE-2026-65905
- https://github.com/apache/tomcat
- https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj
- http://www.openwall.com/lists/oss-security/2026/08/26/4
CVE-2026-65905 · published · modified · JSON