CVE-2026-10050
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode passwords as bytes, silently replacing characters outside that charset with '?'.
Risk Assessment
An attacker can craft a digest Authorization header with a password of only '?' characters, matching any password of the same length containing non-ISO-8859-1 characters, potentially leading to unauthorized access.
Recommendation
Update Eclipse Jetty to a version supporting RFC-7616 with charset=UTF-8 for proper password encoding.
Other vulnerabilities in Eclipse Jetty
See all- CVE-2015-2080High
The exception handling code in Eclipse Jetty before version 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, known as JetLeak.
- CVE-2026-8384Medium
In Eclipse Jetty, a vulnerability has been identified involving incorrect path resolution for URIs containing semicolons. A request to a resource like '/public;/../admin/secret.txt' results in Jetty returning an unresolved path '/public/../admin/secret.txt' instead of the expected '/admin/secret.txt'. Jetty itself is not vulnerable because it does not serve files that fail the alias check, but web applications relying on Jetty's path resolution may be confused.
- CVE-2026-6790Medium
In Eclipse Jetty for HTTP/1, HTTP/2, and HTTP/3 requests, there is no strict check that the request authority (host and port) matches the value provided in the Host header (if present). This mismatch can cause problems such as incorrect URI construction, virtual host selection, reverse proxying, misleading logs, and others.
- CVE-2026-10051High
In Eclipse Jetty, the first HTTP/1.1 request with trailers causes the server to retain those trailers for subsequent requests on the same connection. Subsequent requests without trailers report the trailers from the first request, while requests with their own trailers report the union of the first and current request's trailers.
- CVE-2026-2332High
Eclipse Jetty has an HTTP/1.1 request smuggling vulnerability related to chunk extension handling, where the parser terminates chunk extension parsing at \r\n inside quoted strings instead of treating it as an error.
- CVE-2026-5795High
In Eclipse Jetty, the JASPIAuthenticator class sets ThreadLocal variables during authentication but fails to clear them on early return. A subsequent request on the same thread inherits these values, leading to broken access control and privilege escalation.
- CVE-2026-1605High
In Eclipse Jetty versions 12.0.0-12.0.31 and 12.1.0-12.0.5, the GzipHandler class has a memory leak vulnerability. When a compressed HTTP request with Content-Encoding: gzip is processed and the response is not compressed, the JDK Inflater object is not released, causing a resource leak.
Original NVD description (English source)
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.