CVE-2026-10050

Eclipse Jetty's server-side HTTP Digest authentication encodes passwords as ISO-8859-1 bytes, so any character outside that set (for example Chinese, Cyrillic, or Greek letters) is silently replaced with a '?' during the digest computation. An attacker can send a crafted Digest 'Authorization' header whose password consists solely of '?' characters, and the server will accept it as a match for any user password of the same length that contains non-ISO-8859-1 characters. This results in an authentication bypass (CWE-303, CWE-173): the attacker gains the privileges of the targeted user account, consistent with the CVSS 4.0 score of 8.7 (High) with high confidentiality impact and no direct integrity or availability impact. Only Jetty deployments that use HTTP Digest authentication where at least one account password contains non-Latin characters are affected; deployments using ASCII-only passwords, other authentication mechanisms, or RFC 7616 charset-aware (UTF-8) Digest handling are not impacted. There are no confirmed in-the-wild exploitation reports: the flaw is not in CISA KEV, EPSS estimates a 0.5% probability of exploitation in the next 30 days (40th percentile), and the vendor advisory (GHSA-2fvj-hgj9-j2gr) has been published with details.

What to do: Audit whether your Jetty deployments enable HTTP Digest authentication and whether any Digest-auth accounts use passwords containing non-ASCII characters; if Digest authentication is not enabled, exposure is limited. Upgrade Jetty to the fixed release identified in the vendor advisory GHSA-2fvj-hgj9-j2gr (exact version numbers are not included in the available data). Until patched, mitigate by disabling Digest authentication, restricting Digest-auth accounts to ASCII-only passwords, or rotating any non-Latin passwords that could be impersonated.