# CVE-2026-10050: Eclipse Jetty auth bypass via ISO-8859-1 encoding in Digest Authentication

Source: https://junglewise.ai/threats/cve-2026-10050-eclipse-jetty-auth-bypass-via-iso-8859-1-encoding-in-digest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-10050 · Severity: high · CVSS 4 · Published 2026-07-22

Eclipse Jetty is a widely used web server and software framework for Java applications. A flaw in how it handles security credentials allows attackers to bypass authentication for users who have passwords containing non-English characters (such as Chinese, Arabic, or Emojis). By substituting these special characters with a question mark, an attacker can gain unauthorized access to protected accounts or services.

Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-10050 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10050 being exploited in the wild.

**How severe is CVE-2026-10050?** High severity, with a CVSS score of 4, published 22 July 2026.

**Which products and versions are affected?** Eclipse Foundation Jetty-Ee8-Security >= 12.0.0, <= 12.0.35; Eclipse Foundation Jetty-Ee9-Security >= 12.0.0, <= 12.0.35; Eclipse Foundation Jetty-Security >= 9.4.0.v20161208, <= 9.4.58.v20250814; org.eclipse.jetty:jetty-security (Maven) ECOSYSTEM:introduced=9.4.0.v20161208,fixed=9.4.63; and 2 more.

**Is there a fix for CVE-2026-10050?** Yes. org.eclipse.jetty:jetty-security (Maven): upgrade to 9.4.63 or later; org.eclipse.jetty.ee8:jetty-ee8-security (Maven): upgrade to 12.0.36 or later; org.eclipse.jetty.ee9:jetty-ee9-security (Maven): upgrade to 12.0.36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10050 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10050?** Check whether you run Eclipse Foundation Jetty-Ee8-Security, Eclipse Foundation Jetty-Ee9-Security, Eclipse Foundation Jetty-Security or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.eclipse.jetty:jetty-security (Maven): upgrade to 9.4.63 or later

  ```sh
  # set org.eclipse.jetty:jetty-security to 9.4.63 in your pom.xml or build.gradle
  ```

- org.eclipse.jetty.ee8:jetty-ee8-security (Maven): upgrade to 12.0.36 or later

  ```sh
  # set org.eclipse.jetty.ee8:jetty-ee8-security to 12.0.36 in your pom.xml or build.gradle
  ```

- org.eclipse.jetty.ee9:jetty-ee9-security (Maven): upgrade to 12.0.36 or later

  ```sh
  # set org.eclipse.jetty.ee9:jetty-ee9-security to 12.0.36 in your pom.xml or build.gradle
  ```


## Technical details

The DigestAuthentication.apply() method in Jetty's HTTP client incorrectly uses ISO-8859-1 encoding to compute MD5-based Digest response hashes. Because ISO-8859-1 silently replaces any character above U+00FF (such as CJK, Cyrillic, or Emoji characters) with a literal '?' (0x3F), multiple distinct passwords can produce identical hashes. An attacker knowing a victim's username can bypass authentication by replacing all non-Latin-1 characters in the password with '?' characters. Additionally, this causes a functional denial of service for legitimate users whose passwords contain UTF-8 characters that the client cannot correctly encode. The issue is patched in versions 9.4.63, 10.0.31, 11.0.31, 12.0.36, and 12.1.10.

## Affected products

- Eclipse jetty-security >= 9.4.0.v20161208, <= 9.4.58.v20250814
- Eclipse jetty-security >= 10.0.0, <= 10.0.26
- Eclipse jetty-security >= 11.0.0, <= 11.0.26
- Eclipse jetty-security >= 12.0.0, <= 12.0.35
- Eclipse jetty-security >= 12.1.0, <= 12.1.9
- Eclipse jetty-ee8-security >= 12.0.0, <= 12.0.35
- Eclipse jetty-ee8-security >= 12.1.0, <= 12.1.9
- Eclipse jetty-ee9-security >= 12.0.0, <= 12.0.35
- Eclipse jetty-ee9-security >= 12.1.0, <= 12.1.9

## Identifiers

- CVE-2026-10050
- GHSA-2fvj-hgj9-j2gr

## Timeline

- 2026-07-13: disclosed
- 2026-07-22: advisory

## References

- [https://api.github.com/users/hrykx-zy](https://api.github.com/users/hrykx-zy)
- [https://github.com/hrykx-zy](https://github.com/hrykx-zy)
- [https://api.github.com/users/hrykx-zy/gists%7B/gist_id%7D](https://api.github.com/users/hrykx-zy/gists%7B/gist_id%7D)
- [https://api.github.com/users/hrykx-zy/repos](https://api.github.com/users/hrykx-zy/repos)
- [https://avatars.githubusercontent.com/u/82334182?v=4](https://avatars.githubusercontent.com/u/82334182?v=4)
- [https://api.github.com/users/hrykx-zy/events%7B/privacy%7D](https://api.github.com/users/hrykx-zy/events%7B/privacy%7D)