Apache Tomcat CVE-2026-65905

Requires the DIGEST authenticator to be explicitly configured on the Tomcat Realm (not the default) AND the attacker to already hold a captured, valid DIGEST-authenticated request. The specific trigger is that the captured request's nonceCount is on the upper boundary of the replay window and that fewer than windowSize requests have been made since, so the nonceCount still lies within the window. Limiting factors: exploitation is a one-time replay per captured request; it requires a traffic-capture/MITM position to obtain the original request; it is void on any deployment using FORM/CLIENT-CERT or basic auth; and the timing window (nonceCount boundary before windowSize is exceeded) is narrow, substantially raising real attack complexity beyond the AC:L in the published vector.

The signals conflict sharply. The NVD CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) treats this as trivial unauthenticated network RCE-grade impact, but that rating is inconsistent with the description: exploitation is a capture-replay that requires (a) DIGEST authentication to be configured - not Tomcat's default, (b) the attacker to already possess a captured valid authenticated request (a MITM/traffic-capture position), (c) a specific nonceCount boundary and timing condition, and (d) yields a single replay, not arbitrary repeated access. This warrants AC:H, not AC:L, and materially lower impact than C:H/I:H/A:H. Corroborating the lower real-world risk: EPSS is 0.28% (20th percentile), there is no CISA KEV listing, and no public exploit is identified. This is a genuine correctness bug worth patching on managed cycles, but it is a high-CVSS-but-lower-real-risk issue rather than an emergency, unless DIGEST auth is in use on exposed endpoints. Note the mismatch explicitly: CVSS AC:L/PR:N conflicts with a description that requires captured credentials-in-transit plus a narrow timing window - verify severity against the Apache advisory before prioritizing.

An attacker positioned to observe traffic (e.g., on a shared network segment or via a downgraded/cleartext channel) captures a legitimate user's DIGEST-authenticated HTTP request whose nonceCount happens to fall on the upper boundary of the replay window. Before windowSize further requests are processed, the attacker resends that exact request and Tomcat accepts it a second time, performing the authenticated action without valid credentials. No public exploit code is identified at time of analysis, and the replay succeeds only once per captured request.