CVE-2026-10050: Eclipse Jetty auth bypass via ISO-8859-1 encoding in Digest Authentication

CVE-2026-10050 · Severity: high · CVSS 4 · Published 2026-07-22

Eclipse Jetty is a widely used web server and software framework for Java applications. A flaw in how it handles security credentials allows attackers to bypass authentication for users who have passwords containing non-English characters (such as Chinese, Arabic, or Emojis). By substituting these special characters with a question mark, an attacker can gain unauthorized access to protected accounts or services.

Vendors: Eclipse Foundation, Maven.

Quick answers

Is CVE-2026-10050 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-10050 being exploited in the wild.
How severe is CVE-2026-10050?
High severity, with a CVSS score of 4, published 22 July 2026.
Which products and versions are affected?
Eclipse Foundation Jetty-Ee8-Security >= 12.0.0, <= 12.0.35; Eclipse Foundation Jetty-Ee9-Security >= 12.0.0, <= 12.0.35; Eclipse Foundation Jetty-Security >= 9.4.0.v20161208, <= 9.4.58.v20250814; org.eclipse.jetty:jetty-security (Maven) ECOSYSTEM:introduced=9.4.0.v20161208,fixed=9.4.63; and 2 more.
Is there a fix for CVE-2026-10050?
Yes. org.eclipse.jetty:jetty-security (Maven): upgrade to 9.4.63 or later; org.eclipse.jetty.ee8:jetty-ee8-security (Maven): upgrade to 12.0.36 or later; org.eclipse.jetty.ee9:jetty-ee9-security (Maven): upgrade to 12.0.36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10050 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-10050?
Check whether you run Eclipse Foundation Jetty-Ee8-Security, Eclipse Foundation Jetty-Ee9-Security, Eclipse Foundation Jetty-Security or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.eclipse.jetty:jetty-security (Maven): upgrade to 9.4.63 or later
    # set org.eclipse.jetty:jetty-security to 9.4.63 in your pom.xml or build.gradle
  • org.eclipse.jetty.ee8:jetty-ee8-security (Maven): upgrade to 12.0.36 or later
    # set org.eclipse.jetty.ee8:jetty-ee8-security to 12.0.36 in your pom.xml or build.gradle
  • org.eclipse.jetty.ee9:jetty-ee9-security (Maven): upgrade to 12.0.36 or later
    # set org.eclipse.jetty.ee9:jetty-ee9-security to 12.0.36 in your pom.xml or build.gradle

Technical details

The DigestAuthentication.apply() method in Jetty's HTTP client incorrectly uses ISO-8859-1 encoding to compute MD5-based Digest response hashes. Because ISO-8859-1 silently replaces any character above U+00FF (such as CJK, Cyrillic, or Emoji characters) with a literal '?' (0x3F), multiple distinct passwords can produce identical hashes. An attacker knowing a victim's username can bypass authentication by replacing all non-Latin-1 characters in the password with '?' characters. Additionally, this causes a functional denial of service for legitimate users whose passwords contain UTF-8 characters that the client cannot correctly encode. The issue is patched in versions 9.4.63, 10.0.31, 11.0.31, 12.0.36, and 12.1.10.

Affected products

  • Eclipse jetty-security >= 9.4.0.v20161208, <= 9.4.58.v20250814
  • Eclipse jetty-security >= 10.0.0, <= 10.0.26
  • Eclipse jetty-security >= 11.0.0, <= 11.0.26
  • Eclipse jetty-security >= 12.0.0, <= 12.0.35
  • Eclipse jetty-security >= 12.1.0, <= 12.1.9
  • Eclipse jetty-ee8-security >= 12.0.0, <= 12.0.35
  • Eclipse jetty-ee8-security >= 12.1.0, <= 12.1.9
  • Eclipse jetty-ee9-security >= 12.0.0, <= 12.0.35
  • Eclipse jetty-ee9-security >= 12.1.0, <= 12.1.9

Identifiers

  • CVE-2026-10050
  • GHSA-2fvj-hgj9-j2gr

Timeline

  • 2026-07-13: disclosed
  • 2026-07-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.