CVE-2026-10050
published 2026-08-04CVE-2026-10050: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial…
PriorityP357critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.48%
39.8th percentile
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.
This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.
If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.
An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.
Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| eclipse | jetty | >= 10.0.0 < 10.0.31 | 10.0.31 |
| eclipse | jetty | >= 11.0.0 < 11.0.31 | 11.0.31 |
| eclipse | jetty | >= 12.0.0 < 12.0.36 | 12.0.36 |
| eclipse | jetty | >= 12.1.0 < 12.1.10 | 12.1.10 |
| eclipse | jetty | >= 9.4.0 < 9.4.63 | 9.4.63 |
| eclipse_foundation | eclipse_jetty | 10.0.0 – 10.0.30 | — |
| eclipse_foundation | eclipse_jetty | 11.0.0 – 11.0.30 | — |
| eclipse_foundation | eclipse_jetty | 12.0.0 – 12.0.35 | — |
| eclipse_foundation | eclipse_jetty | 12.1.0 – 12.1.9 | — |
| eclipse_foundation | eclipse_jetty | 9.4.0 – 9.4.62 | — |
| eclipse_foundation | eclipse_jetty_ee8 | 12.0.0 – 12.0.35 | — |
| eclipse_foundation | eclipse_jetty_ee8 | 12.1.0 – 12.1.9 | — |
| eclipse_foundation | eclipse_jetty_ee9 | 12.0.0 – 12.0.35 | — |
| eclipse_foundation | eclipse_jetty_ee9 | 12.1.0 – 12.1.9 | — |
| jenkins | jenkins | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| offline-knowledge-portal | rhokp-rhel9 | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
ghsa·2026-07-22
CVE-2026-10050 [HIGH] CWE-173 Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
### Summary
The `DigestAuthentication.apply()` method in Jetty's HTTP client uses `getBytes(StandardCharsets.ISO_8859_1)` at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emoji, etc.) with 0x3F (`?`), causing all such characters to produce identical hash contributions. An attacker who knows a victim's username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with `?` characters, since the collision password produces the same MD5-based Digest response hash as the original password.
### Details
### Root Cause
Red Hat
jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision
vendor_redhat·2026-07-16·CVSS 9.1
CVE-2026-10050 [CRITICAL] CWE-303 jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision
jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.
This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.
If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.
An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-IS
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-04
Published