Jetty Digest Auth ISO-8859-1 Encoding Flaw
CVE-2026-10050 Published on August 4, 2026
Digest authentication lossy encoding
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.
This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.
If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `123` converts to `??123`.
An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.
Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.
Vulnerability Analysis
CVE-2026-10050 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
Improper Handling of Alternate Encoding
The software does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.
Incorrect Implementation of Authentication Algorithm
The requirements for the software dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. This incorrect implementation may allow authentication to be bypassed.
Products Associated with CVE-2026-10050
Want to know whenever a new CVE is published for Eclipse Jetty? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse Jetty - EE8:- Version 12.0.0, <= 12.0.35 is affected.
- Version 12.1.0, <= 12.1.9 is affected.
- Version 12.0.0, <= 12.0.35 is affected.
- Version 12.1.0, <= 12.1.9 is affected.
- Version 9.4.0, <= 9.4.62 is affected.
- Version 10.0.0, <= 10.0.30 is affected.
- Version 11.0.0, <= 11.0.30 is affected.
- Version 12.0.0, <= 12.0.35 is affected.
- Version 12.1.0, <= 12.1.9 is affected.