CVE-2026-10050 Digest authentication lossy encoding

What is CVE-2026-10050?

CVE-2026-10050 is a high-severity authentication bypass vulnerability in Eclipse Jetty, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.

This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.

If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.

An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.

Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Weakness: CWE-303, CWE-173

Which versions are affected by CVE-2026-10050?

18 open source packages ship an affected version, including org.eclipse.jetty:jetty-security, org.eclipse.jetty.ee8:jetty-ee8-security and org.eclipse.jetty.ee9:jetty-ee9-security. It affects 1 product.

Products include Eclipse Jetty.

How do I fix CVE-2026-10050?

Upgrade org.eclipse.jetty:jetty-security to a fixed version for your release line: 10.0.31, 11.0.31, 12.0.36 or 12.1.10.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-10050 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-10050 exists.

Other vulnerabilities in Eclipse Jetty

• CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request Critical 9.8
• CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server Critical 9.4
• CVE-2018-12538 Access and integrity issue within Eclipse Jetty High 8.8
• CVE-2025-5115 MadeYouReset HTTP/2 vulnerability High 7.7
• CVE-2024-7708 Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests High 7.5

All Eclipse Jetty vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-AF46685, CLEANSTART-2026-EQ95867, CLEANSTART-2026-GQ21179, CLEANSTART-2026-IG26643, CLEANSTART-2026-KO81202, CLEANSTART-2026-LN18272 and 74 more.