CVE-2026-10050

Name of the Vulnerable Software and Affected Versions Eclipse Jetty (affected versions not specified)

Description The Digest authentication server-side component and the DigestAuthentication.apply() method in the HTTP client use ISO-8859-1 encoding to process passwords. Because ISO-8859-1 cannot represent characters outside the U+0000–U+00FF range (such as Chinese, Japanese, Cyrillic, Arabic, Greek, or emojis), these characters are silently replaced by the ? character (byte 0x3F). This behavior leads to hash collisions where different passwords containing non-Latin-1 characters produce identical MD5-based Digest response hashes.

An attacker who knows a victim's username can bypass authentication by crafting a password consisting of ? characters to match the length of the non-ISO-8859-1 characters in the original password. Additionally, this causes a functional failure where legitimate users with non-Latin-1 characters in their passwords cannot authenticate if the server expects UTF-8 encoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.