CVE-2026-10050

Digest authentication lossy encoding

Published Aug 4, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.

This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.

If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.

An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.

Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Analysis

Technical impact

The flaw causes Jetty to encode passwords using ISO-8859-1, silently replacing unsupported characters with ‘?’; an attacker can craft a Digest Authorization header with a password consisting only of ‘?’ characters, and the server will match it against any non‑ISO‑8859‑1 password of the same length. This allows remote authentication as any user whose password contains non‑ASCII characters, representing an authentication bypass vulnerability. The weakness falls under the Critical Security Weaknesses CWE‑173 (Lossy Encoding) and CWE‑303 (Improper Authentication).

Affected Systems

The Eclipse Foundation’s Jetty web server, including the standard Jetty distribution, Jetty EE8, and Jetty EE9 are affected. No specific version numbers are given, so any instance running these products should be assumed vulnerable until a patch is applied.

Risk and Exploitability

With a CVSS score of 8.7 this vulnerability is considered high severity. No EPSS score is available and it is not listed in CISA’s KEV catalog, yet the simplicity of the attack path means it can be executed remotely from any client capable of sending a HTTP Digest Authorization request. The attacker only needs the target username and can then authenticate by sending the specially crafted header.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Eclipse Foundation

Eclipse Jetty - EE8

unaffected

Version	Status	Constraints
`12.0.0`	affected	≤ 12.0.35
`12.1.0`	affected	≤ 12.1.9

Eclipse Foundation

Eclipse Jetty - EE9

unaffected

Version	Status	Constraints
`12.0.0`	affected	≤ 12.0.35
`12.1.0`	affected	≤ 12.1.9

Eclipse Foundation

Eclipse Jetty

unaffected

Version	Status	Constraints
`9.4.0`	affected	≤ 9.4.62
`10.0.0`	affected	≤ 10.0.30
`11.0.0`	affected	≤ 11.0.30
`12.0.0`	affected	≤ 12.0.35
`12.1.0`	affected	≤ 12.1.9

Configuration 1 [-]

OR	cpe:2.3:a:eclipse:jetty::::::::
	cpe:2.3:a:eclipse:jetty::::::::
	cpe:2.3:a:eclipse:jetty::::::::
	cpe:2.3:a:eclipse:jetty::::::::
	cpe:2.3:a:eclipse:jetty::::::::

No data.

Vendor Product Versions

Eclipse

Jetty

Version	Status	Scheme	Platform
`[12.0.0,12.0.35]`	affected	semver	—
`[12.1.0,12.1.9]`	affected	semver	—

Eclipse

Jetty

Version	Status	Scheme	Platform
`[9.4.0,9.4.62]`	affected	semver	—
`[10.0.0,10.0.30]`	affected	semver	—
`[11.0.0,11.0.30]`	affected	semver	—
`[12.0.0,12.0.35]`	affected	semver	—
`[12.1.0,12.1.9]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Jetty to the latest release that implements RFC–7616 charset UTF‑8 handling for Digest authentication.
If an immediate update is not possible, configure the Jetty server to reject or reject Digest requests that contain non‑ISO‑8859‑1 characters by enforcing the charset parameter or disabling Digest authentication entirely.
Implement a password policy that restricts users to ASCII‑only characters or otherwise prevents the use of non‑ASCII characters in passwords until the patch is deployed.

Generated by OpenCVE AI on August 4, 2026 at 20:02 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-2fvj-hgj9-j2gr	Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.632% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120

History

Aug 5, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Eclipse Eclipse jetty
Vendors & Products		Eclipse Eclipse jetty

Aug 4, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 4, 2026 11:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.
Title		Digest authentication lossy encoding
Weaknesses		CWE-173 CWE-303
References		https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`