SECUFOCUSNOW
Home›CVE index›CVE-2026-10050
ReviewHigh

CVE-2026-10050

Eclipse Foundation Eclipse Jetty - EE8, Eclipse Jetty - EE9, Eclipse Jetty

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password...

CVSS
8.7
EPSS
0.48%
39.8% percentile
CISA KEV
Not listed
Published
2026.08.04
PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.48%
Technical severityCVSS 8.7

Vulnerability overview

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password...

Affected product and versions

Product
Eclipse Foundation Eclipse Jetty - EE8, Eclipse Jetty - EE9, Eclipse Jetty
Affected versions
>= 12.0.0 <= 12.0.35, >= 12.1.0 <= 12.1.9, >= 9.4.0 <= 9.4.62, >= 10.0.0 <= 10.0.30, >= 11.0.0 <= 11.0.30, >= 9.4.0 < 9.4.63, >= 10.0.0 < 10.0.31, >= 11.0.0 < 11.0.31, >= 12.0.0 < 12.0.36, >= 12.1.0 < 12.1.10
Fixed versions
9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Eclipse Foundation Eclipse Jetty - EE8, Eclipse Jetty - EE9, Eclipse Jetty and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE
CWE-173, CWE-303
CVE-2026-10050 — Eclipse Foundation Eclipse Jetty - EE8, Eclipse Jetty - EE9, Eclipse Jetty | SECUFOCUS NOW