CVE-2026-10050
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode passwords as bytes, silently replacing characters outside that charset with '?'.
Risk Assessment
An attacker can craft a digest Authorization header with a password of only '?' characters, matching any password of the same length containing non-ISO-8859-1 characters, potentially leading to unauthorized access.
Recommendation
Update Eclipse Jetty to a version supporting RFC-7616 with charset=UTF-8 for proper password encoding.
Original NVD description (English source)
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.