Riskcovery

CVE-2026-10050

Digest authentication lossy encoding

State
Published
Severity
8.7 High
Published
Aug 4, 2026
Updated
Aug 4, 2026
Reserved
May 29, 2026

Read the record on cve.org

Description

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.

This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.

If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.

An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.

Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:Neclipse

Weaknesses

Affected Products

ProductVersions
Eclipse Jetty - EE8Eclipse Foundation
  • 12.0.0 through 12.0.35Affected
  • 12.1.0 through 12.1.9Affected
Eclipse Jetty - EE9Eclipse Foundation
  • 12.0.0 through 12.0.35Affected
  • 12.1.0 through 12.1.9Affected
Eclipse JettyEclipse Foundation
  • 9.4.0 through 9.4.62Affected
  • 10.0.0 through 10.0.30Affected
  • 11.0.0 through 11.0.30Affected
  • 12.0.0 through 12.0.35Affected
  • 12.1.0 through 12.1.9Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.