Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.eclipse.jetty.ee9:jetty-ee9-security

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7MavenPublished

    Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

    CVE-2026-10050 · GHSA-2fvj-hgj9-j2gr

    Affected
    • Maven org.eclipse.jetty.ee9:jetty-ee9-security >= 12.0.0, <= 12.0.35; >= 12.1.0, <= 12.1.9
    Fixed in
    12.0.3612.1.10· Vendor fix available
    Issue
    The DigestAuthentication.apply() method in Jetty's HTTP client uses getBytes(StandardCharsets.ISO88591) at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emoji, etc.) with 0x3F (?), causing all such characters to produce identical hash contributions. An attacker who knows a victim's username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with ? characters, since the collision password produces the same MD5-based Digest response hash as the original password. Details Root Cause In jetty-core/jetty-client/src/main/java/org/eclipse/jetty/client/DigestAuthentication.java, the apply() method computes the three Digest auth hashes (H(A1), H(A2), and the final response) using ISO-8859-1 character encoding: ISO-8859-1 (Latin-1) can only encode characters in the range U+0000–U+00FF. Any character outside this range —…

    Recommended action: Upgrade to 12.1.10 or 12.0.36 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →