CVE-2026-10050: Digest authentication lossy encoding
Eclipse Foundation · Eclipse Jetty - EE8
Affected: Eclipse Foundation Eclipse Jetty - EE8 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 50% of scored CVEs
DescriptionCVE.org
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.
Affected products3
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Eclipse Foundation · Eclipse Jetty - EE8from 12.0.0 up to and including 12.0.35; from 12.1.0 up to and including 12.1.9
- Eclipse Foundation · Eclipse Jetty - EE9from 12.0.0 up to and including 12.0.35; from 12.1.0 up to and including 12.1.9
- Eclipse Foundation · Eclipse Jettyfrom 9.4.0 up to and including 9.4.62; from 10.0.0 up to and including 10.0.30; from 11.0.0 up to and including 11.0.30; from 12.0.0 up to and including 12.0.35; from 12.1.0 up to and including 12.1.9
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Eclipse Foundation
- Published
- August 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-10050 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.