CVE-2026-10050

Summary

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.

This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.

If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by ?. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: αβ123 converts to ??123.

An attacker can send a request with a digest Authorization header crafted with a password made of only ? characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.

Recent HTTP Digest RFC-7616 supports a charset parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Affected Software

VendorProductVersion RangeStatus
Eclipse FoundationEclipse Jetty - EE812.0.0 <= 12.0.35affected
Eclipse FoundationEclipse Jetty - EE812.1.0 <= 12.1.9affected
Eclipse FoundationEclipse Jetty - EE912.0.0 <= 12.0.35affected
Eclipse FoundationEclipse Jetty - EE912.1.0 <= 12.1.9affected
Eclipse FoundationEclipse Jetty9.4.0 <= 9.4.62affected
Eclipse FoundationEclipse Jetty10.0.0 <= 10.0.30affected
Eclipse FoundationEclipse Jetty11.0.0 <= 11.0.30affected
Eclipse FoundationEclipse Jetty12.0.0 <= 12.0.35affected
Eclipse FoundationEclipse Jetty12.1.0 <= 12.1.9affected

Weaknesses

  • CWE-173: CWE-173
  • CWE-303: CWE-303

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

Additional References

References