CVE-2026-10050: 
Java 脆弱性の分析と軽減

CVE-2026-10050 is an authentication bypass vulnerability in Eclipse Jetty's HTTP Digest authentication implementation, caused by lossy ISO-8859-1 character encoding. The DigestAuthentication.apply() method in Jetty's HTTP client uses getBytes(StandardCharsets.ISO_8859_1) to compute Digest auth response hashes (H(A1), H(A2), and the final response), silently replacing any character above U+00FF with 0x3F (?). An attacker who knows a victim's username can bypass Digest authentication by substituting all non-Latin-1 characters in the password with ?, producing an identical MD5-based hash. Affected packages include org.eclipse.jetty:jetty-security (versions 9.4.0.v20161208–9.4.58.v20250814, 10.0.0–10.0.26, 11.0.0–11.0.26, 12.0.0–12.0.35, 12.1.0–12.1.9) and related EE8/EE9 security artifacts. The vulnerability was published to the GitHub Advisory Database on July 22, 2026, with a CVSS v4 base score of 8.7 (High) (GitHub Advisory).

The root cause is classified as CWE-173 (Improper Handling of Alternate Encoding) and CWE-303 (Incorrect Implementation of Authentication Algorithm). In DigestAuthentication.java, the apply() method calls a1.getBytes(StandardCharsets.ISO_8859_1) at lines 171, 179, and 196 to encode the username, realm, password, and URI strings before hashing. Java's String.getBytes(ISO_8859_1) silently maps any character outside U+0000–U+00FF to the byte 0x3F (?) without raising an exception, meaning passwords containing CJK, Cyrillic, Arabic, Greek, Hangul, emoji, or Latin Extended characters (> U+00FF) are encoded identically to a string where those characters are replaced with ?. As a result, an attacker who knows the victim's username can craft a "collision password" by replacing all non-Latin-1 characters with ?, which produces the same MD5 digest response as the legitimate password. The fix, implemented in commits 4bcdbc7 and d0bb829, replaces the lossy encoding with a strict encoder (CodingErrorAction.REPORT) and adds RFC 7616 support, using UTF-8 when the server advertises it via the charset parameter (GitHub Advisory, Jetty Commit).

Successful exploitation allows an unauthenticated network attacker to authenticate as any user whose password contains characters outside the Latin-1 range (U+00FF), including users with Chinese, Japanese, Korean, Cyrillic, Arabic, Greek, or emoji passwords. This results in a high confidentiality impact — the attacker gains unauthorized access to resources protected by Digest authentication on the affected Jetty instance. Additionally, legitimate users with non-Latin-1 passwords may be unable to authenticate at all (a functional denial-of-service), since the ISO-8859-1-encoded hash sent by the Jetty client will not match the UTF-8-based hash stored by the server (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability requires no authentication, no privileges, and no user interaction — an attacker only needs to know the target username and that the victim's password contains non-Latin-1 characters. The attack is network-accessible and low complexity, making it straightforward to exploit once a target is identified. No threat actor attribution, EPSS score, or CISA KEV catalog entry has been reported for this CVE.

1. Reconnaissance: Identify services using Eclipse Jetty with HTTP Digest authentication enabled, targeting versions in the affected ranges (e.g., jetty-security 9.4.x through 9.4.58, 10.0.x through 10.0.26, 11.0.x through 11.0.26, 12.0.x through 12.0.35, 12.1.x through 12.1.9). Tools like Shodan or Censys can identify Jetty-powered endpoints.
2. Identify target user: Determine a valid username for the target service (e.g., via user enumeration, public directories, or prior knowledge). The attack requires knowing the username but not the actual password.
3. Determine password character set: Assess whether the target user is likely to have a password containing non-Latin-1 characters (e.g., CJK, Cyrillic, Arabic, Greek, emoji). This may be inferred from the application's user base or locale settings.
4. Craft collision password: Replace all non-Latin-1 characters (any character > U+00FF) in a guessed or known password pattern with the ? character (0x3F). For example, if the password is suspected to be 密码123, the collision password is ??123.
5. Send Digest authentication request: Initiate an HTTP request to the Digest-protected endpoint. When challenged with a WWW-Authenticate: Digest header, compute the MD5-based Digest response using the collision password and the known username, following RFC 2617/7616 mechanics.
6. Achieve authentication bypass: The server receives a Digest response hash identical to what the legitimate user's client would send (due to the ISO-8859-1 lossy encoding on the server side), and grants access (GitHub Advisory).

• Network: HTTP requests to Digest-authenticated endpoints with Authorization: Digest headers where the username field matches a known user but the password used is a ?-substituted variant; repeated authentication attempts from unexpected source IPs against Digest-protected resources.
• Logs: Jetty access logs showing successful 200 OK responses to Digest-authenticated endpoints from IP addresses not associated with the legitimate user; authentication success events for users with non-Latin-1 passwords from unfamiliar clients or geographic locations.
• Behavioral: Successful logins by users with non-Latin-1 passwords from clients that do not typically use those accounts; access to sensitive resources immediately following a successful Digest authentication from an anomalous source.

Upgrade to the following patched versions, which implement RFC 7616 and replace the lossy ISO-8859-1 encoding with strict UTF-8 encoding: jetty-security 9.4.63, 10.0.31, 11.0.31, 12.0.36, or 12.1.10; jetty-ee8-security and jetty-ee9-security 12.0.36 or 12.1.10 (GitHub Advisory). As an interim workaround, require all users with non-Latin-1 characters in their passwords to change to Latin-1-only passwords, and audit accounts for unauthorized access. Consider adding network-level access controls (e.g., IP allowlisting) to Digest-protected endpoints until patching is complete.

HeroDevs published a vulnerability directory entry and blog post covering CVE-2026-10050, noting the authentication bypass risk for users with non-Latin-1 passwords (HeroDevs Blog). The vulnerability was also tracked by GitLab Advisories and OSV.dev shortly after the GitHub Advisory was published. Community discussion on LinkedIn noted the practical impact on internationalized deployments.