CVE-2026-10050: Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
(updated )
The DigestAuthentication.apply() method in Jetty’s HTTP client uses getBytes(StandardCharsets.ISO_8859_1) at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emoji, etc.) with 0x3F (?), causing all such characters to produce identical hash contributions. An attacker who knows a victim’s username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with ? characters, since the collision password produces the same MD5-based Digest response hash as the original password.
References
- github.com/advisories/GHSA-2fvj-hgj9-j2gr
- github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d
- github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d
- github.com/jetty/jetty.project/issues/15136
- github.com/jetty/jetty.project/pull/15160
- github.com/jetty/jetty.project/pull/15183
- github.com/jetty/jetty.project/releases/tag/jetty-12.0.36
- github.com/jetty/jetty.project/releases/tag/jetty-12.1.10
- github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr
- nvd.nist.gov/vuln/detail/CVE-2026-10050
Code Behaviors & Features
Detect and mitigate CVE-2026-10050 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →