---
title: "CVE-2026-65905"
source: https://dev.pageseeder.com/guide/security/advisories/cve-2026-65905.html
description: "CVE-2026-65905 describes a limited replay vulnerability in Apache Tomcat's DIGEST authentication affecting versions 9.0.0.M1 through 9.0.120. PageSeeder 6.3003 is not affected because it does not use Tomcat DIGEST authentication in its standard configuration."
last_updated: 2026-11-13T09:42:40+11:00
tokens: ~1075
---

# CVE-2026-65905


        *Apache Tomcat: Limited replay against DIGEST authentication*
      

| Property | Value |
| --- | --- |
| Published | 2026-08-25 |
| Last updated | 2026-11-11 |
| Component | Apache Tomcat |
| Severity | Critical |
| PageSeeder status | Not affected |

## Summary

A boundary condition in Tomcat DIGEST authentication can permit one replay of a captured authenticated request while its nonce count remains in the replay window.

The issue affects Apache Tomcat 9.0.0.M1 through 9.0.120 in the 9.0 branch and is fixed in Tomcat 9.0.121. The bundled version, 9.0.120, falls within this version range; exploitability depends on the conditions described below.

The Critical classification reflects the CISA assessment in the CVE record: 9.8 (CVSS 3.1). Apache rates this issue Low. The upstream severity is distinct from PageSeeder exposure.

For technical details, see the [Apache Tomcat security advisory](https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj).

## PageSeeder impact assessment

| Property | Value |
| --- | --- |
| Affected dependency | Apache Tomcat 9.0.120 (bundled) |
| PageSeeder versions assessed | Reviewed repository: 6.3003, bundling Tomcat 9.0.120; historical releases not independently assessed |
| Vulnerability status | Not affected |
| Conditions required for exploitation |  |
| Relevant PageSeeder configuration |  |
| Assessment date | 2026-11-11 |

### Assessment

PageSeeder is not affected by CVE-2026-65905 in the reviewed standard configuration because the required configuration or application usage was not found.

Required conditions for exploitation: Tomcat DIGEST authentication and a captured authenticated request whose nonce count lies at the upper boundary of the replay window, while that count remains within the window.

Relevant PageSeeder configuration: No Tomcat DIGEST authentication login-config was found in the supplied PageSeeder applications.

Evidence from source and configuration review:

- No Tomcat DIGEST authentication configuration was found in the reviewed application descriptors.
- The flaw concerns Tomcat’s DIGEST authenticator; unrelated application authentication does not establish this prerequisite.

This assessment is limited to the repository revision and configuration reviewed on 11 November 2026. It does not independently verify the historical PageSeeder version range in the model advisory. Customised connectors, deployment descriptors, extensions and additional web applications may change exposure.

The PageSeeder installer source was also reviewed at commit a08323b (Windows, Linux EL7, EL8 and EL9). Installer review supports the standard configuration assessment; it does not establish the configuration of every deployed server. Linux RPM packaging marks server.xml CONFIG | NOREPLACE, so existing administrator changes can survive upgrades.

## Recommended action

Administrators who enable Tomcat DIGEST authentication should upgrade to Tomcat 9.0.121 or later, preferably 9.0.123 or later. Include additional hosted applications in the configuration review.

For installations matching the reviewed unaffected configuration, no CVE-specific emergency change is required. Confirm the installed configuration before relying on this conclusion. Use a supported PageSeeder distribution containing an updated Tomcat where available; this advisory does not announce a PageSeeder release date or confirm that such a distribution has shipped.

Dependency maintenance recommendation: update the bundled Tomcat to 9.0.123 or a later supported release, which also incorporates fixes for the other Critical CVEs covered in this advisory set.

> **Warning:** This assessment is based on source code and configuration review. It has not been verified through deployed server inspection or active exploit testing.

## References

- 
          [CVE-2026-65905 record and CISA severity assessment](https://www.cve.org/CVERecord?id=CVE-2026-65905)
        
- 
          [Apache Tomcat security advisory](https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj)
        
- 
          [Apache Tomcat 9 security advisories](https://tomcat.apache.org/security-9)
        
- 
          [Apache Tomcat 9 changelog](https://tomcat.apache.org/tomcat-9.0-doc/changelog.html)