CVE-2026-10050
Digest authentication lossy encoding
- Published
- Updated
- Reserved
- Assigned by
- eclipse
Description
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| eclipseCNA (assigner) | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| NVDNVD · Analyzed | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.63% · top 50% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.
Weakness
Affected products
Eclipse Foundation · Eclipse Jetty - EE8
- affected 12.0.0 – ≤ 12.0.35
- affected 12.1.0 – ≤ 12.1.9
Eclipse Foundation · Eclipse Jetty - EE9
- affected 12.0.0 – ≤ 12.0.35
- affected 12.1.0 – ≤ 12.1.9
Eclipse Foundation · Eclipse Jetty
- affected 9.4.0 – ≤ 9.4.62
- affected 10.0.0 – ≤ 10.0.30
- affected 11.0.0 – ≤ 11.0.30
- affected 12.0.0 – ≤ 12.0.35
- affected 12.1.0 – ≤ 12.1.9
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.eclipse.jetty.ee8:jetty-ee8-securityGHSA-2fvj-hgj9-j2gr (opens in a new tab)
- Mavenorg.eclipse.jetty.ee9:jetty-ee9-securityGHSA-2fvj-hgj9-j2gr (opens in a new tab)
- Mavenorg.eclipse.jetty:jetty-securityGHSA-2fvj-hgj9-j2gr (opens in a new tab)
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-2fvj-hgj9-j2gr (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-10050)Record last updated .