tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component...

tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component...

tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component...

CVE-2026-73443

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be...

CVE-2026-73443 On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be...

EUVD-2026-80996

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be...

Replay Attack

Overview org.http4s:http4s-server2.12 is a base library for building http4s servers. Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously...

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously captured Authorization header. Workaround Users that are not able to upgrade to...

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously captured Authorization header. Workaround Users that are not able to upgrade to...

CVE-2026-69206

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored...

GHSA-9XWW-74XV-GJFP Http4s: DigestAuth allows replay of captured requests

The DigestAuth replay defence stores lastNc + 1 rather than the nonce-count nc value it just accepted. When a legitimate client sends non-contiguous nc values parallel or retried requests, as browsers do, the server's counter lags behind the highest nc seen, and a captured Authorization header ca...

Http4s: DigestAuth allows replay of captured requests

The DigestAuth replay defence stores lastNc + 1 rather than the nonce-count nc value it just accepted. When a legitimate client sends non-contiguous nc values parallel or retried requests, as browsers do, the server's counter lags behind the highest nc seen, and a captured Authorization header ca...

CVE-2026-69206

Http4s (a Scala HTTP service framework) has a DigestAuth replay vulnerability prior to versions 0.23.35 and 1.0.0-M47 . The replay protection records lastNc + 1 instead of the highest accepted nonce-count value. When a legitimate client sends noncontiguous nc values (due to parallel or retried re...

CVE-2026-69206 Http4s: DigestAuth allows replay of captured requests

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored...

CVE-2026-69206 Http4s: DigestAuth allows replay of captured requests

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored...

PT-2026-92424

Name of the Vulnerable Software and Affected Versions Http4s versions prior to 0.23.35 Http4s versions prior to 1.0.0-M47 Description DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc valu...

Fedora 45 : perl-Authen-SASL (2026-81cd7d0f41)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-81cd7d0f41 advisory. 2.2100 - CVE-2026-86219: Replay attack in Authen::SASL::Perl::DIGESTMD5 Thanks to TIMLEGGE @timlegge and the CPANSec team for the AI-assisted detection and...

Fedora 44 : perl-Authen-SASL (2026-53e2875c88)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-53e2875c88 advisory. 2.2100 - CVE-2026-86219: Replay attack in Authen::SASL::Perl::DIGESTMD5 Thanks to TIMLEGGE @timlegge and the CPANSec team for the AI-assisted detection and...

CVE-2026-54155

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcuaserver.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session...

OESA-2026-3778 perl-Authen-SASL security update

Authen::SASL::Perl is the pure Perl implementation of SASL mechanisms in the Authen::SASL framework, At the time of this writing it provides the client part implementation for the following SASL mechanisms. Security Fixes: Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept...