critical
CVE-2026-10050
jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high).
Description
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| chainguard | akhq, apache-hop, apache-hop-fips and 37 more | 0.27.1-r10 and 34 more |
| debian 11 | jetty9 | no fix listed |
| debian 12 | jetty9 | no fix listed |
| debian 13 | jetty12, jetty9 | no fix listed |
| debian 14 | jetty12, jetty9 | no fix listed |
| echo | jetty12, jetty9 | no fix listed |
| echo maven::Echo OSV | org.eclipse.jetty.ee8:jetty-ee8-security, org.eclipse.jetty.ee9:jetty-ee9-security, org.eclipse.jetty:jetty-security | 9.4.63 and 1 more |
| maven::GitHub Security Advisory Maven | org.eclipse.jetty.ee8:jetty-ee8-security, org.eclipse.jetty.ee9:jetty-ee9-security, org.eclipse.jetty:jetty-security | 12.0.36, 12.1.10 and 1 more |
| minimos | apache-activemq-artemis, apache-druid, apache-druid-fips and 23 more | 2.55.0-r0 and 17 more |
| rapidfort debian 12 | jetty12, jetty9 | 0:12.0.39-1 |
| rapidfort debian 13 | jetty12, jetty9 | 0:12.0.39-1 |
| rapidfort fedora 43 | jetty, jetty-client, jetty-continuation and 12 more | 9.4.40-18.fc43 |
Show all 119 entries from 15 sources
| Source | Package | Fixed in |
|---|---|---|
| chainguard | akhq | 0.27.1-r10 |
| chainguard | apache-hop | 2.18.1-r16 |
| chainguard | apache-hop-fips | 2.18.1-r8 |
| chainguard | apache-jena-fuseki | 6.1.0-r4 |
| chainguard | apache-tika-3.0 | 3.0.0-r31 |
| chainguard | apache-tika-3.1 | 3.1.0-r38 |
| chainguard | apache-tika-3.2 | 3.2.3-r18 |
| chainguard | apache-tika-3.3 | 3.3.2-r2 |
| chainguard | apache-tika-fips-3.0 | 3.0.0-r13 |
| chainguard | apache-tika-fips-3.1 | 3.1.0-r15 |
| chainguard | apache-tika-fips-3.2 | 3.2.3-r13 |
| chainguard | apache-tika-fips-3.3 | 3.3.2-r4 |
| chainguard | automq | 1.7.4-r1 |
| chainguard | automq-fips | 1.7.4-r1 |
| chainguard | cloudwatch-exporter | 0.18.0-r5 |
| chainguard | confluent-kafka | 8.4.0.397-r0 |
| chainguard | confluent-kafka-jre-bcfips | 8.4.0.382-r0 |
| chainguard | cruise-control | 0 |
| chainguard | cruise-control-fips | 0 |
| chainguard | dependency-track | 4.14.3-r0 |
| chainguard | druid | 37.0.0-r56 |
| chainguard | jenkins-2.568 | 2.568.1-r1 |
| chainguard | kafka-4.0 | 4.0.2-r7 |
| chainguard | kafka-fips-4.3 | 4.3.1-r3 |
| chainguard | neo4j-2026.03 | 2026.03.1-r1 |
| chainguard | neo4j-2026.06 | 2026.06.0-r3 |
| chainguard | neo4j-5.26 | 5.26.28-r5 |
| chainguard | reposilite | 3.6.2-r2 |
| chainguard | solr-10 | 10.0.0-r8 |
| chainguard | solr-fips-10 | 10.0.0-r2 |
| chainguard | spark-4.2 | 4.2.0-r1 |
| chainguard | spark-fips-4.2 | 4.2.0-r1 |
| chainguard | spark-kubernetes-operator | 1.0.0-r0 |
| chainguard | spark-kubernetes-operator-fips | 1.0.0-r0 |
| chainguard | strimzi-kafka-operator | 0 |
| chainguard | strimzi-kafka-operator-fips | 1.1.0-r5 |
| chainguard | tez | 0.10.5-r22 |
| chainguard | traccar | 6.14.5-r1 |
| chainguard | traccar-fips | 6.14.5-r3 |
| chainguard | trino | 483-r7 |
| debian 11 | jetty9 | no fix listed |
| debian 12 | jetty9 | no fix listed |
| debian 13 | jetty12 | no fix listed |
| debian 13 | jetty9 | no fix listed |
| debian 14 | jetty12 | no fix listed |
| debian 14 | jetty9 | no fix listed |
| echo | jetty12 | no fix listed |
| echo | jetty9 | no fix listed |
| echo maven::Echo OSV | org.eclipse.jetty.ee8:jetty-ee8-security | 9.4.63 |
| echo maven::Echo OSV | org.eclipse.jetty.ee9:jetty-ee9-security | 9.4.63 |
| echo maven::Echo OSV | org.eclipse.jetty:jetty-security | 10.0.26+echo.2 |
| maven::GitHub Security Advisory Maven | org.eclipse.jetty.ee8:jetty-ee8-security | 12.0.36, 12.1.10 |
| maven::GitHub Security Advisory Maven | org.eclipse.jetty.ee9:jetty-ee9-security | 12.0.36, 12.1.10 |
| maven::GitHub Security Advisory Maven | org.eclipse.jetty:jetty-security | 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 |
| minimos | apache-activemq-artemis | 2.55.0-r0 |
| minimos | apache-druid | 38.0.0-r0 |
| minimos | apache-druid-fips | 38.0.0-r0 |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-hop-fips | 2.19.0-r0 |
| minimos | apache-nifi | 2.10.0-r0 |
| minimos | apache-nifi-registry | 2.10.0-r0 |
| minimos | cassandra-reaper | 5.0.0-r0 |
| minimos | cloudwatch-exporter | 0.17.0-r0 |
| minimos | datahub-frontend-react | 1.7.0-r0 |
| minimos | datahub-frontend-react-fips | 1.7.0-r0 |
| minimos | jenkins | 2.569-r0 |
| minimos | jenkins-2.568 | 2.568.3-r0 |
| minimos | jetty-12.0 | 12.0.36-r0 |
| minimos | jetty-12.0-fips | 12.0.36-r0 |
| minimos | jetty-12.1 | 12.1.10-r0 |
| minimos | jetty-12.1-fips | 12.1.10-r0 |
| minimos | kafka-3.9 | 3.9.2-r5 |
| minimos | kafka-4.2 | 4.2.2-r0 |
| minimos | kafka-4.2-fips | 4.2.2-r0 |
| minimos | neo4j-5.26 | 5.26.29-r0 |
| minimos | opensearch-3 | 3.9.0-r0 |
| minimos | strimzi-kafka-operator | 1.0.1-r4 |
| minimos | strimzi-kafka-operator-0.45 | 0.45.2-r11 |
| minimos | trino | 482-r0 |
| minimos | trino-fips | 482-r0 |
| rapidfort debian 12 | jetty12 | 0:12.0.39-1 |
| rapidfort debian 12 | jetty9 | no fix listed |
| rapidfort debian 13 | jetty12 | 0:12.0.39-1 |
| rapidfort debian 13 | jetty9 | no fix listed |
| rapidfort fedora 43 | jetty | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-client | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-continuation | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-http | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-io | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-jaas | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-javadoc | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-jmx | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-security | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-server | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-servlet | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-util | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-util-ajax | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-webapp | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-xml | 9.4.40-18.fc43 |
| Red Hat | jmc | no fix listed |
| Red Hat | satellite:el8::puppetserver | no fix listed |
| seal maven::Seal Security Database | org.apache.spark:spark-core_2.11 | 2.4.8+sp999 |
| seal maven::Seal Security Database | org.apache.spark:spark-core_2.13 | 4.0.0-preview2+sp999, 4.0.1+sp999, 4.0.2+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.spark:spark-core_2.11 | 2.4.8+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.spark:spark-core_2.13 | 4.0.0-preview2+sp999, 4.0.1+sp999, 4.0.2+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.apache.spark:spark-core_2.11 | 2.4.8+sp999 |
| wolfi | akhq | 0.27.1-r10 |
| wolfi | apache-tika-3.1 | 3.1.0-r38 |
| wolfi | apache-tika-3.2 | 3.2.3-r18 |
| wolfi | apache-tika-3.3 | 3.3.2-r2 |
| wolfi | cloudwatch-exporter | 0.18.0-r5 |
| wolfi | confluent-kafka | 8.4.0.397-r0 |
| wolfi | dependency-track | 4.14.3-r0 |
| wolfi | druid | 37.0.0-r56 |
| wolfi | neo4j-2026.06 | 2026.06.0-r3 |
| wolfi | solr-10 | 10.0.0-r8 |
| wolfi | strimzi-kafka-operator | 0 |
| wolfi | tez | 0.10.5-r22 |
| wolfi | trino | 483-r7 |
References
- https://access.redhat.com/security/cve/CVE-2026-10050
- https://advisory.echohq.com/cve/CVE-2026-10050
- https://github.com/jetty/jetty.project
- https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d
- https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d
- https://github.com/jetty/jetty.project/issues/15136
- https://github.com/jetty/jetty.project/pull/15160
- https://github.com/jetty/jetty.project/pull/15183
All 14 references
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10
- https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120
- https://nvd.nist.gov/vuln/detail/CVE-2026-10050
- https://www.cve.org/CVERecord?id=CVE-2026-10050