Executive brief
Eclipse Jetty is a widely used web server and software framework for Java applications. A flaw in how it handles security credentials allows attackers to bypass authentication for users who have passwords containing non-English characters (such as Chinese, Arabic, or Emojis). By substituting these special characters with a question mark, an attacker can gain unauthorized access to protected accounts or services.
Technical details
The DigestAuthentication.apply() method in Jetty's HTTP client incorrectly uses ISO-8859-1 encoding to compute MD5-based Digest response hashes. Because ISO-8859-1 silently replaces any character above U+00FF (such as CJK, Cyrillic, or Emoji characters) with a literal '?' (0x3F), multiple distinct passwords can produce identical hashes. An attacker knowing a victim's username can bypass authentication by replacing all non-Latin-1 characters in the password with '?' characters. Additionally, this causes a functional denial of service for legitimate users whose passwords contain UTF-8 characters that the client cannot correctly encode. The issue is patched in versions 9.4.63, 10.0.31, 11.0.31, 12.0.36, and 12.1.10.
Affected products
- Eclipse jetty-security >= 9.4.0.v20161208, <= 9.4.58.v20250814
- Eclipse jetty-security >= 10.0.0, <= 10.0.26
- Eclipse jetty-security >= 11.0.0, <= 11.0.26
- Eclipse jetty-security >= 12.0.0, <= 12.0.35
- Eclipse jetty-security >= 12.1.0, <= 12.1.9
- Eclipse jetty-ee8-security >= 12.0.0, <= 12.0.35
- Eclipse jetty-ee8-security >= 12.1.0, <= 12.1.9
- Eclipse jetty-ee9-security >= 12.0.0, <= 12.0.35
- Eclipse jetty-ee9-security >= 12.1.0, <= 12.1.9
Timeline
- 2026-07-13: disclosed
- 2026-07-22: advisory