Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.eclipse.jetty:jetty-security

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7MavenPublished

    Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

    CVE-2026-10050 · GHSA-2fvj-hgj9-j2gr

    Affected
    • Maven org.eclipse.jetty:jetty-security >= 9.4.0.v20161208, <= 9.4.58.v20250814; >= 10.0.0, <= 10.0.26; >= 11.0.0, <= 11.0.26; >= 12.0.0, <= 12.0.35; >= 12.1.0, <= 12.1.9
    Fixed in
    11.0.3112.0.3612.1.109.4.6310.0.31· Vendor fix available
    Issue
    The DigestAuthentication.apply() method in Jetty's HTTP client uses getBytes(StandardCharsets.ISO88591) at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emoji, etc.) with 0x3F (?), causing all such characters to produce identical hash contributions. An attacker who knows a victim's username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with ? characters, since the collision password produces the same MD5-based Digest response hash as the original password. Details Root Cause In jetty-core/jetty-client/src/main/java/org/eclipse/jetty/client/DigestAuthentication.java, the apply() method computes the three Digest auth hashes (H(A1), H(A2), and the final response) using ISO-8859-1 character encoding: ISO-8859-1 (Latin-1) can only encode characters in the range U+0000–U+00FF. Any character outside this range —…

    Recommended action: Upgrade to 12.1.10, 12.0.36, 11.0.31 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →