Skip to main content
Public proof of conceptFix available

CVE-2026-10050

Digest authentication lossy encoding

A public proof of concept exists; no exploitation attested.

  • Published2026-08-04
  • Fixed in12.1.10 · 12.0.36 · 11.0.31 · 10.0.31 · 9.4.63
  • WeaknessCWE-173 · CWE-303

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Timeline

dates in UTC
  1. 2026-08-0411:22CVE publishedNVD

Versions per branch

NVD · OSV
Eclipse jetty
BranchAffectedFixed in
12.1≥ 12.1.0, < 12.1.1012.1.10
12.0≥ 12.0.0, < 12.0.3612.0.36
11.0≥ 11.0.0, < 11.0.3111.0.31
10.0≥ 10.0.0, < 10.0.3110.0.31
9.4≥ 9.4.0, < 9.4.639.4.63
9.4≥ 9.4.0.v20161208, < 9.4.639.4.63

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Products declared by the CNA3 products

As eclipse, the CNA that assigned this CVE, declared them in the CVE record; versions as written.

  • Eclipse Foundation Eclipse Jetty - EE8other versions: not affected

    package org.eclipse.jetty.ee8:jetty-ee8-security

    Affected
    • ≥ 12.0.0, ≤ 12.0.35no fix statedsemver
    • ≥ 12.1.0, ≤ 12.1.9no fix statedsemver
  • Eclipse Foundation Eclipse Jetty - EE9other versions: not affected

    package org.eclipse.jetty.ee9:jetty-ee9-security

    Affected
    • ≥ 12.0.0, ≤ 12.0.35no fix statedsemver
    • ≥ 12.1.0, ≤ 12.1.9no fix statedsemver
  • Eclipse Foundation Eclipse Jettyother versions: not affected

    package org.eclipse.jetty:jetty-security

    Affected
    • ≥ 9.4.0, ≤ 9.4.62no fix statedsemver
    • ≥ 10.0.0, ≤ 10.0.30no fix statedsemver
    • ≥ 11.0.0, ≤ 11.0.30no fix statedsemver
    • ≥ 12.0.0, ≤ 12.0.35no fix statedsemver
    • ≥ 12.1.0, ≤ 12.1.9no fix statedsemver

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2026-08-04

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • activemqCleanStartall versions · fixed in 6.2.8-r1
  • activemqCleanStartall versions · fixed in 6.2.8-r2
  • akhqWolfiall versions · fixed in 0.27.1-r10
  • akhqChainguardall versions · fixed in 0.27.1-r10
  • apache-activemq-artemisMinimOSall versions · fixed in 2.55.0-r0
  • apache-druidMinimOSall versions · fixed in 38.0.0-r0and 1 other package
  • apache-hiveCleanStartall versions · fixed in 3.1.3-r4
  • apache-hiveCleanStartall versions · fixed in 4.0.1-r8

162 more package ranges on OSV.dev

Vendor advisories

  • CVE-2026-10050 Red Hat Product Security55 products fixed · 10 known affected

    jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision

    jenkins.src as a component of OpenShift Developer Tools and Services · jetty-security as a component of Red Hat build of Apache Camel - HawtIO 4 · jetty-security as a component of Red Hat build of Debezium 3 · +7 more

  • RHSA-2026:88159 Red Hat Product Security4 products fixed

    Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.

  • RHSA-2026:88158 Red Hat Product Security4 products fixed

    Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.

  • RHSA-2026:88157 Red Hat Product Security4 products fixed

    Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.

  • RHSA-2026:88156 Red Hat Product Security4 products fixed

    Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.

  • RHSA-2026:88155 Red Hat Product Security4 products fixed

    Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.

12 more advisories

Full record on NVD

Fix

  1. Update Eclipse jetty to 12.1.10 · 12.0.36 · 11.0.31 · 10.0.31 · 9.4.63
  2. Vendor fix Red Hat Product Security RHSA-2026:88159 · 4 productsIt is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-17 upgrade to the latest.
  3. Vendor fix Red Hat Product Security RHSA-2026:88158 · 4 productsIt is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-19 upgrade to the latest.
  4. Vendor fix Red Hat Product Security RHSA-2026:88157 · 4 productsIt is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-20 upgrade to the latest.
  5. Vendor fix Red Hat Product Security RHSA-2026:88156 · 4 productsIt is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-16 upgrade to the latest.
  6. Vendor fix Red Hat Product Security RHSA-2026:88155 · 4 productsIt is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-21 upgrade to the latest.
  7. Vendor fix Red Hat Product Security RHSA-2026:88154 · 4 productsIt is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-22 upgrade to the latest.

Advisories and patches

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof of concept
Metasploit modules
none listed
Metasploit Framework

Sources

  • CISA-ADPSSVC decisionpoc2026-08-04
  • CNACVSS 4.08.7known since 2026-10-23
  • NVDCVSS 3.19.1read 2026-10-23
  • CNAweakness (CWE)CWE-173, CWE-303known since 2026-10-23
  • FIRST EPSSEPSS score0.6 %2026-11-06
  • OSVaffected packages—
  • GitHub AdvisoriesadvisoryHIGH2026-07-22

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 4.0 vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
2026-08-04
Last Modified
2026-08-08
NVD status
Analyzed
GitHub Advisory
GHSA-2fvj-hgj9-j2gr

Frequently asked questions

What is CVE-2026-10050?

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Is CVE-2026-10050 actively exploited?

A proof-of-concept exploit exists for CVE-2026-10050, but active exploitation has not been confirmed at this time.

What is the CVSS score for CVE-2026-10050?

CVE-2026-10050 has a CVSS v3 base score of 9.1 (CRITICAL severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.

Running jetty-security? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record