CVE-2026-10050
org.eclipse.jetty.ee8:jetty-ee8-security: Improper Handling of Alternate Encoding (CVE-2026-10050)
criticalEPSS 0.6%
Affected
- maven/org.eclipse.jetty:jetty-security
9.4.0.v20161208..* - maven/org.eclipse.jetty:jetty-security
9.4.0.v20180619..* - maven/org.eclipse.jetty:jetty-security
9.4.1.v20170120..* - maven/org.eclipse.jetty:jetty-security
9.4.1.v20180619..* - maven/org.eclipse.jetty:jetty-security
9.4.10.RC0..* - maven/org.eclipse.jetty:jetty-security
9.4.10.RC1..* - maven/org.eclipse.jetty:jetty-security
9.4.10.v20180503..* - maven/org.eclipse.jetty:jetty-security
9.4.11.v20180605..* - maven/org.eclipse.jetty:jetty-security
9.4.12.RC0..* - maven/org.eclipse.jetty:jetty-security
9.4.12.RC1..* - maven/org.eclipse.jetty:jetty-security
9.4.12.RC2..* - maven/org.eclipse.jetty:jetty-security
9.4.12.v20180830..* - maven/org.eclipse.jetty:jetty-security
9.4.13.v20181111..* - maven/org.eclipse.jetty:jetty-security
9.4.14.v20181114..* - maven/org.eclipse.jetty:jetty-security
9.4.15.v20190215..* - maven/org.eclipse.jetty:jetty-security
9.4.16.v20190411..* - maven/org.eclipse.jetty:jetty-security
9.4.17.v20190418..* - maven/org.eclipse.jetty:jetty-security
9.4.18.v20190429..* - maven/org.eclipse.jetty:jetty-security
9.4.19.v20190610..* - maven/org.eclipse.jetty:jetty-security
9.4.2.v20170220..* - maven/org.eclipse.jetty:jetty-security
9.4.2.v20180619..* - maven/org.eclipse.jetty:jetty-security
9.4.20.v20190813..* - maven/org.eclipse.jetty:jetty-security
9.4.21.v20190926..* - maven/org.eclipse.jetty:jetty-security
9.4.22.v20191022..* - maven/org.eclipse.jetty:jetty-security
9.4.23.v20191118..* - maven/org.eclipse.jetty:jetty-security
9.4.24.v20191120..* - maven/org.eclipse.jetty:jetty-security
9.4.25.v20191220..* - maven/org.eclipse.jetty:jetty-security
9.4.26.v20200117..* - maven/org.eclipse.jetty:jetty-security
9.4.27.v20200227..* - maven/org.eclipse.jetty:jetty-security
9.4.28.v20200408..* - maven/org.eclipse.jetty:jetty-security
9.4.29.v20200521..* - maven/org.eclipse.jetty:jetty-security
9.4.3.v20170317..* - maven/org.eclipse.jetty:jetty-security
9.4.3.v20180619..* - maven/org.eclipse.jetty:jetty-security
9.4.30.v20200611..* - maven/org.eclipse.jetty:jetty-security
9.4.31.v20200723..* - maven/org.eclipse.jetty:jetty-security
9.4.32.v20200930..* - maven/org.eclipse.jetty:jetty-security
9.4.33.v20201020..* - maven/org.eclipse.jetty:jetty-security
9.4.34.v20201102..* - maven/org.eclipse.jetty:jetty-security
9.4.35.v20201120..* - maven/org.eclipse.jetty:jetty-security
9.4.36.v20210114..* - maven/org.eclipse.jetty:jetty-security
9.4.37.v20210219..* - maven/org.eclipse.jetty:jetty-security
9.4.38.v20210224..* - maven/org.eclipse.jetty:jetty-security
9.4.39.v20210325..* - maven/org.eclipse.jetty:jetty-security
9.4.4.v20170414..* - maven/org.eclipse.jetty:jetty-security
9.4.4.v20180619..* - maven/org.eclipse.jetty:jetty-security
9.4.40.v20210413..* - maven/org.eclipse.jetty:jetty-security
9.4.41.v20210516..* - maven/org.eclipse.jetty:jetty-security
9.4.42.v20210604..* - maven/org.eclipse.jetty:jetty-security
9.4.43.v20210629..* - maven/org.eclipse.jetty:jetty-security
9.4.44.v20210927..* - maven/org.eclipse.jetty:jetty-security
9.4.45.v20220203..* - maven/org.eclipse.jetty:jetty-security
9.4.46.v20220331..* - maven/org.eclipse.jetty:jetty-security
9.4.47.v20220610..* - maven/org.eclipse.jetty:jetty-security
9.4.48.v20220622..* - maven/org.eclipse.jetty:jetty-security
9.4.49.v20220914..* - maven/org.eclipse.jetty:jetty-security
9.4.5.v20170502..* - maven/org.eclipse.jetty:jetty-security
9.4.5.v20180619..* - maven/org.eclipse.jetty:jetty-security
9.4.50.v20221201..* - maven/org.eclipse.jetty:jetty-security
9.4.51.v20230217..* - maven/org.eclipse.jetty:jetty-security
9.4.52.v20230823..* - maven/org.eclipse.jetty:jetty-security
9.4.53.v20231009..* - maven/org.eclipse.jetty:jetty-security
9.4.54.v20240208..* - maven/org.eclipse.jetty:jetty-security
9.4.55.v20240627..* - maven/org.eclipse.jetty:jetty-security
9.4.56.v20240826..* - maven/org.eclipse.jetty:jetty-security
9.4.57.v20241219..* - maven/org.eclipse.jetty:jetty-security
9.4.58.v20250814..* - maven/org.eclipse.jetty:jetty-security
9.4.6.v20170531..* - maven/org.eclipse.jetty:jetty-security
9.4.6.v20180619..* - maven/org.eclipse.jetty:jetty-security
9.4.7.RC0..* - maven/org.eclipse.jetty:jetty-security
9.4.7.v20170914..* - maven/org.eclipse.jetty:jetty-security
9.4.7.v20180619..* - maven/org.eclipse.jetty:jetty-security
9.4.8.v20171121..* - maven/org.eclipse.jetty:jetty-security
9.4.8.v20180619..* - maven/org.eclipse.jetty:jetty-security
9.4.9.v20180320..* - maven/org.eclipse.jetty:jetty-security
10.0.0..* - maven/org.eclipse.jetty:jetty-security
10.0.1..* - maven/org.eclipse.jetty:jetty-security
10.0.10..* - maven/org.eclipse.jetty:jetty-security
10.0.11..* - maven/org.eclipse.jetty:jetty-security
10.0.12..* - maven/org.eclipse.jetty:jetty-security
10.0.13..* - maven/org.eclipse.jetty:jetty-security
10.0.14..* - maven/org.eclipse.jetty:jetty-security
10.0.15..* - maven/org.eclipse.jetty:jetty-security
10.0.16..* - maven/org.eclipse.jetty:jetty-security
10.0.17..* - maven/org.eclipse.jetty:jetty-security
10.0.18..* - maven/org.eclipse.jetty:jetty-security
10.0.19..* - maven/org.eclipse.jetty:jetty-security
10.0.2..* - maven/org.eclipse.jetty:jetty-security
10.0.20..* - maven/org.eclipse.jetty:jetty-security
10.0.21..* - maven/org.eclipse.jetty:jetty-security
10.0.22..* - maven/org.eclipse.jetty:jetty-security
10.0.23..* - maven/org.eclipse.jetty:jetty-security
10.0.24..* - maven/org.eclipse.jetty:jetty-security
10.0.25..* - maven/org.eclipse.jetty:jetty-security
10.0.26..* - maven/org.eclipse.jetty:jetty-security
10.0.3..* - maven/org.eclipse.jetty:jetty-security
10.0.4..* - maven/org.eclipse.jetty:jetty-security
10.0.5..* - maven/org.eclipse.jetty:jetty-security
10.0.6..* - maven/org.eclipse.jetty:jetty-security
10.0.7..* - maven/org.eclipse.jetty:jetty-security
10.0.8..* - maven/org.eclipse.jetty:jetty-security
10.0.9..* - maven/org.eclipse.jetty:jetty-security
11.0.0..* - maven/org.eclipse.jetty:jetty-security
11.0.1..* - maven/org.eclipse.jetty:jetty-security
11.0.10..* - maven/org.eclipse.jetty:jetty-security
11.0.11..* - maven/org.eclipse.jetty:jetty-security
11.0.12..* - maven/org.eclipse.jetty:jetty-security
11.0.13..* - maven/org.eclipse.jetty:jetty-security
11.0.14..* - maven/org.eclipse.jetty:jetty-security
11.0.15..* - maven/org.eclipse.jetty:jetty-security
11.0.16..* - maven/org.eclipse.jetty:jetty-security
11.0.17..* - maven/org.eclipse.jetty:jetty-security
11.0.18..* - maven/org.eclipse.jetty:jetty-security
11.0.19..* - maven/org.eclipse.jetty:jetty-security
11.0.2..* - maven/org.eclipse.jetty:jetty-security
11.0.20..* - maven/org.eclipse.jetty:jetty-security
11.0.21..* - maven/org.eclipse.jetty:jetty-security
11.0.22..* - maven/org.eclipse.jetty:jetty-security
11.0.23..* - maven/org.eclipse.jetty:jetty-security
11.0.24..* - maven/org.eclipse.jetty:jetty-security
11.0.25..* - maven/org.eclipse.jetty:jetty-security
11.0.26..* - maven/org.eclipse.jetty:jetty-security
11.0.3..* - maven/org.eclipse.jetty:jetty-security
11.0.4..* - maven/org.eclipse.jetty:jetty-security
11.0.5..* - maven/org.eclipse.jetty:jetty-security
11.0.6..* - maven/org.eclipse.jetty:jetty-security
11.0.7..* - maven/org.eclipse.jetty:jetty-security
11.0.8..* - maven/org.eclipse.jetty:jetty-security
11.0.9..* - maven/org.eclipse.jetty:jetty-security
12.0.0..* - maven/org.eclipse.jetty:jetty-security
12.0.1..* - maven/org.eclipse.jetty:jetty-security
12.0.10..* - maven/org.eclipse.jetty:jetty-security
12.0.11..* - maven/org.eclipse.jetty:jetty-security
12.0.12..* - maven/org.eclipse.jetty:jetty-security
12.0.13..* - maven/org.eclipse.jetty:jetty-security
12.0.14..* - maven/org.eclipse.jetty:jetty-security
12.0.15..* - maven/org.eclipse.jetty:jetty-security
12.0.16..* - maven/org.eclipse.jetty:jetty-security
12.0.17..* - maven/org.eclipse.jetty:jetty-security
12.0.18..* - maven/org.eclipse.jetty:jetty-security
12.0.19..* - maven/org.eclipse.jetty:jetty-security
12.0.2..* - maven/org.eclipse.jetty:jetty-security
12.0.20..* - maven/org.eclipse.jetty:jetty-security
12.0.21..* - maven/org.eclipse.jetty:jetty-security
12.0.22..* - maven/org.eclipse.jetty:jetty-security
12.0.23..* - maven/org.eclipse.jetty:jetty-security
12.0.24..* - maven/org.eclipse.jetty:jetty-security
12.0.25..* - maven/org.eclipse.jetty:jetty-security
12.0.26..* - maven/org.eclipse.jetty:jetty-security
12.0.27..* - maven/org.eclipse.jetty:jetty-security
12.0.28..* - maven/org.eclipse.jetty:jetty-security
12.0.29..* - maven/org.eclipse.jetty:jetty-security
12.0.3..* - maven/org.eclipse.jetty:jetty-security
12.0.30..* - maven/org.eclipse.jetty:jetty-security
12.0.31..* - maven/org.eclipse.jetty:jetty-security
12.0.32..* - maven/org.eclipse.jetty:jetty-security
12.0.33..* - maven/org.eclipse.jetty:jetty-security
12.0.34..* - maven/org.eclipse.jetty:jetty-security
12.0.35..* - maven/org.eclipse.jetty:jetty-security
12.0.4..* - maven/org.eclipse.jetty:jetty-security
12.0.5..* - maven/org.eclipse.jetty:jetty-security
12.0.6..* - maven/org.eclipse.jetty:jetty-security
12.0.7..* - maven/org.eclipse.jetty:jetty-security
12.0.8..* - maven/org.eclipse.jetty:jetty-security
12.0.9..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.0..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.1..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.10..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.11..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.12..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.13..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.14..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.15..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.16..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.17..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.18..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.19..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.2..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.20..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.21..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.22..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.23..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.24..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.25..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.26..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.27..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.28..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.29..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.3..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.30..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.31..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.32..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.33..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.34..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.35..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.4..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.5..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.6..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.7..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.8..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.0.9..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.0..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.1..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.10..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.11..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.12..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.13..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.14..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.15..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.16..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.17..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.18..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.19..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.2..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.20..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.21..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.22..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.23..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.24..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.25..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.26..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.27..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.28..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.29..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.3..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.30..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.31..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.32..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.33..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.34..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.35..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.4..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.5..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.6..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.7..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.8..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.0.9..* - maven/org.eclipse.jetty:jetty-security
12.1.0..* - maven/org.eclipse.jetty:jetty-security
12.1.1..* - maven/org.eclipse.jetty:jetty-security
12.1.2..* - maven/org.eclipse.jetty:jetty-security
12.1.3..* - maven/org.eclipse.jetty:jetty-security
12.1.4..* - maven/org.eclipse.jetty:jetty-security
12.1.5..* - maven/org.eclipse.jetty:jetty-security
12.1.6..* - maven/org.eclipse.jetty:jetty-security
12.1.7..* - maven/org.eclipse.jetty:jetty-security
12.1.8..* - maven/org.eclipse.jetty:jetty-security
12.1.9..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.1.0..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.1.1..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.1.2..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.1.3..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.1.4..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.1.5..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.1.6..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.1.7..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.1.8..* - maven/org.eclipse.jetty.ee8:jetty-ee8-security
12.1.9..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.1.0..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.1.1..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.1.2..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.1.3..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.1.4..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.1.5..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.1.6..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.1.7..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.1.8..* - maven/org.eclipse.jetty.ee9:jetty-ee9-security
12.1.9..*
Description
A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain characters, leading to a weakness in how passwords are processed. A remote attacker could exploit this by crafting a specific password that generates the same internal hash as a legitimate user's password, thereby bypassing authentication and gaining unauthorized access to the victim's account.
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
mavenorg.eclipse.jetty.ee8:jetty-ee8-security
12.0.012.0.112.0.1012.0.1112.0.1212.0.1312.0.1412.0.1512.0.1612.0.1712.0.1812.0.1912.0.212.0.2012.0.2112.0.2212.0.2312.0.2412.0.2512.0.2612.0.2712.0.2812.0.2912.0.312.0.3012.0.3112.0.3212.0.3312.0.3412.0.3512.0.412.0.512.0.612.0.712.0.812.0.912.1.012.1.112.1.212.1.312.1.412.1.512.1.612.1.712.1.812.1.9mavenorg.eclipse.jetty.ee9:jetty-ee9-security
12.0.012.0.1Metrics
Show all metrics
Severity
critical
90.28
no public PoC known
9.1
8.7
Published
2026-08-17 16:52 UTC
CWE-173, CWE-303
Weakness classes (CWE)
CWE-173Variant
Improper Handling of Alternate Encoding
The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.
cwe.mitre.org →CWE-303Base
Incorrect Implementation of Authentication Algorithm
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
cwe.mitre.org →
References & sources
- https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2grweb
- https://github.com/jetty/jetty.project/issues/15136web
- https://github.com/jetty/jetty.project/pull/15160web
- https://github.com/jetty/jetty.project/pull/15183web
- https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221dweb
- https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222dweb
- https://github.com/jetty/jetty.projectpackage
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36web
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10web
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120
Reanalysis & status changes
Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.
- Initial Analysis2026-08-08 00:38 UTC· nvd@nist.gov
- CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- CPE Configuration: OR *cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* versions from (including) 12.0.0 up to (excluding) 12.0.36 *cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* versions from (including) 12.1.0 up to (excluding) 12.1.10 *cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* versions from (including) 10.0.0 up to (excluding) 10.0.31 *cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (excluding) 11.0.31 *cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* versions from (including) 9.4.0 up to (excluding) 9.4.63
- Reference Type: Eclipse Foundation: https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr Types: Exploit, Vendor Advisory
- Reference Type: Eclipse Foundation: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120 Types: Issue Tracking
- CVE Modified2026-08-04 13:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
- Reference: https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr
- SSVC: {"id":"CVE-2026-10050","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalI…
- New CVE Received2026-08-04 11:22 UTC· emo@eclipse.org
- Affected: Eclipse Jetty - EE8, Eclipse Jetty - EE9, Eclipse Jetty
- Description: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.
- CVSS V4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CWE: CWE-173