What is GHSA-9xv2-5v5q-p794?

GHSA-9xv2-5v5q-p794 is a security advisory published by GitHub Security Advisories with Critical severity. Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

Which CVE IDs does GHSA-9xv2-5v5q-p794 cover?

GHSA-9xv2-5v5q-p794 covers the following CVE IDs: CVE-2026-65905. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9xv2-5v5q-p794?

GHSA-9xv2-5v5q-p794 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-9xv2-5v5q-p794?

GHSA-9xv2-5v5q-p794 affects 15 products, including: maven/org.apache.tomcat:tomcat:\u003e= 11.0.0-M1, \u003c 11.0.25; maven/org.apache.tomcat:tomcat:\u003e= 10.1.0-M1, \u003c 10.1.58; maven/org.apache.tomcat:tomcat:\u003e= 9.0.0.M1, \u003c 9.0.121; maven/org.apache.tomcat:tomcat:\u003e= 8.5.0, \u003c= 8.5.100; maven/org.apache.tomcat:tomcat:\u003e= 7.0.30, \u003c= 7.0.109; and others — see the full list on the advisory page.

GHSA-9xv2-5v5q-p794CriticalCVSS 9.8

Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

Vendor

GitHub Security Advisories

Published

August 26, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-65905 →

📋 Description

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

🎯 Affected products15

maven/org.apache.tomcat:tomcat:>= 11.0.0-M1, < 11.0.25
maven/org.apache.tomcat:tomcat:>= 10.1.0-M1, < 10.1.58
maven/org.apache.tomcat:tomcat:>= 9.0.0.M1, < 9.0.121
maven/org.apache.tomcat:tomcat:>= 8.5.0, <= 8.5.100
maven/org.apache.tomcat:tomcat:>= 7.0.30, <= 7.0.109
maven/org.apache.tomcat.embed:tomcat-embed-core:>= 11.0.0-M1, < 11.0.25
maven/org.apache.tomcat.embed:tomcat-embed-core:>= 10.1.0-M1, < 10.1.58
maven/org.apache.tomcat.embed:tomcat-embed-core:>= 9.0.0.M1, < 9.0.121
maven/org.apache.tomcat.embed:tomcat-embed-core:>= 8.5.0, <= 8.5.100
maven/org.apache.tomcat.embed:tomcat-embed-core:>= 7.0.30, <= 7.0.109
maven/org.apache.tomcat:tomcat-catalina:>= 11.0.0-M1, < 11.0.25
maven/org.apache.tomcat:tomcat-catalina:>= 10.1.0-M1, < 10.1.58
maven/org.apache.tomcat:tomcat-catalina:>= 9.0.0.M1, < 9.0.121
maven/org.apache.tomcat:tomcat-catalina:>= 8.5.0, <= 8.5.100
maven/org.apache.tomcat:tomcat-catalina:>= 7.0.30, <= 7.0.109

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products15

🔗 References (4)