Vulnerability · Published Aug 4, 2026 · Assigned by eclipse
CVE-2026-10050Digest authentication lossy encoding
High 8.7
In plain English
A high-severity security flaw in Eclipse Jetty from Eclipse Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | jetty12 | no fix listed | DEBIAN-CVE-2026-10050 |
| Debian:14 | jetty12 | 12.0.39-1 | DEBIAN-CVE-2026-10050 |
| Debian:12 | jetty9 | no fix listed | DEBIAN-CVE-2026-10050 |
| Debian:13 | jetty9 | no fix listed | DEBIAN-CVE-2026-10050 |
| Debian:14 | jetty9 | no fix listed | DEBIAN-CVE-2026-10050 |
| Maven | org.eclipse.jetty.ee8:jetty-ee8-security | 12.0.36 | GHSA-2fvj-hgj9-j2gr |
| Maven | org.eclipse.jetty.ee8:jetty-ee8-security | 12.1.10 | GHSA-2fvj-hgj9-j2gr |
| Maven | org.eclipse.jetty.ee9:jetty-ee9-security | 12.0.36 | GHSA-2fvj-hgj9-j2gr |
| Maven | org.eclipse.jetty.ee9:jetty-ee9-security | 12.1.10 | GHSA-2fvj-hgj9-j2gr |
| Maven | org.eclipse.jetty:jetty-security | 9.4.63 | GHSA-2fvj-hgj9-j2gr |
| Maven | org.eclipse.jetty:jetty-security | 10.0.31 | GHSA-2fvj-hgj9-j2gr |
| Maven | org.eclipse.jetty:jetty-security | 11.0.31 | GHSA-2fvj-hgj9-j2gr |
| Maven | org.eclipse.jetty:jetty-security | 12.0.36 | GHSA-2fvj-hgj9-j2gr |
| Maven | org.eclipse.jetty:jetty-security | 12.1.10 | GHSA-2fvj-hgj9-j2gr |
| Ubuntu:26.04:LTS | jetty12 | no fix listed | UBUNTU-CVE-2026-10050 |
| Ubuntu:26.10 | jetty12 | no fix listed | UBUNTU-CVE-2026-10050 |
| Ubuntu:22.04:LTS | jetty9 | no fix listed | UBUNTU-CVE-2026-10050 |
| Ubuntu:24.04:LTS | jetty9 | no fix listed | UBUNTU-CVE-2026-10050 |
| Ubuntu:26.04:LTS | jetty9 | no fix listed | UBUNTU-CVE-2026-10050 |
| Ubuntu:26.10 | jetty9 | no fix listed | UBUNTU-CVE-2026-10050 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse Jetty - EE8 | 12.0.0 – through 12.0.3512.1.0 – through 12.1.9 |
| Eclipse Foundation | Eclipse Jetty - EE9 | 12.0.0 – through 12.0.3512.1.0 – through 12.1.9 |
| Eclipse Foundation | Eclipse Jetty | 9.4.0 – through 9.4.6210.0.0 – through 10.0.3011.0.0 – through 11.0.3012.0.0 – through 12.0.3512.1.0 – through 12.1.9 |
Weakness: CWE-173, CWE-303 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N