CVE-2026-10050: 
Java vulnerability analysis and mitigation

CVE-2026-10050 is an authentication bypass vulnerability in Eclipse Jetty's Digest Authentication implementation caused by ISO-8859-1 lossy character encoding. The DigestAuthentication.apply() method encodes passwords using ISO-8859-1, which silently replaces any character above U+00FF (e.g., Chinese, Cyrillic, Greek, Arabic, emoji) with the byte 0x3F (?). An attacker who knows a victim's username can craft a Digest Authorization header using a password composed entirely of ? characters in place of non-Latin-1 characters, producing an identical MD5 hash and bypassing authentication. Affected versions include org.eclipse.jetty:jetty-security 9.4.0–9.4.62, 10.0.0–10.0.30, 11.0.0–11.0.30, 12.0.0–12.0.35, and 12.1.0–12.1.9. The vulnerability was published on July 13, 2026, and carries a CVSS v3.1 score of 9.1 (Critical) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Jetty Advisory).

The root cause is classified under CWE-173 (Improper Handling of Alternate Encoding) and CWE-303 (Incorrect Implementation of Authentication Algorithm). In DigestAuthentication.java, the apply() method calls getBytes(StandardCharsets.ISO_8859_1) at three locations (lines 171, 179, and 196) to compute the H(A1), H(A2), and final response hashes for Digest authentication. Java's String.getBytes(ISO_8859_1) silently maps any character outside U+0000–U+00FF to the byte 0x3F (?) without raising an error, meaning passwords containing CJK, Cyrillic, Greek, Arabic, or emoji characters are truncated to a shorter, collision-prone byte sequence. The advisory includes a proof-of-concept demonstrating that passwords such as 密码123 (Chinese), аб123 (Cyrillic), and αβ123 (Greek) all produce the identical MD5 H(A1) hash db87f31e8d96cd15f9acec7eabdc4560 as the attacker-supplied ??123, confirming the collision (GitHub Advisory, Jetty Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass Digest authentication and gain unauthorized access to any Jetty-protected resource, provided the legitimate user's password contains non-ISO-8859-1 characters. This results in a high confidentiality impact, as the attacker can access protected data and functionality without valid credentials. A secondary impact is a functional denial of service for legitimate users whose passwords contain non-Latin-1 characters, as those users can never successfully authenticate via Digest auth when the server stores UTF-8-derived hashes — effectively locking out a significant portion of non-European-language users (GitHub Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available; the GitHub Security Advisory includes hash collision examples that illustrate the bug but do not constitute a functional attack tool (Jetty Advisory). The NVD SSVC assessment classifies the vulnerability as having a PoC available and being automatable, indicating low exploitation complexity once a target with non-Latin-1 passwords is identified. The EPSS score is approximately 0.41% (39th percentile), suggesting a relatively low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify internet-facing services running Eclipse Jetty with Digest authentication enabled. Confirm the Jetty version is in the affected range (9.4.0–9.4.62, 10.0.0–10.0.30, 11.0.0–11.0.30, 12.0.0–12.0.35, or 12.1.0–12.1.9) via HTTP response headers (e.g., Server: Jetty(...)) or service fingerprinting tools like Shodan or Nmap.
2. Identify target username: Obtain a valid username through enumeration, leaked credentials, public directories, or social engineering. The attacker must know the username to craft a valid Digest response.
3. Determine password structure: Determine or guess that the target user's password contains non-ISO-8859-1 characters (e.g., Chinese, Cyrillic, Greek). This may be inferred from the user's locale, organization, or prior data exposure.
4. Craft collision password: Replace all non-Latin-1 characters (U+0100 and above) in the known or guessed password with ? (0x3F). For example, if the password is αβ123, the collision password is ??123. If the exact password is unknown but its length is known, try all-? strings of the same length.
5. Send crafted Digest Authorization header: Construct a valid HTTP Digest Authorization header using the target username, the collision password, and the server's nonce (obtained from the WWW-Authenticate challenge). The MD5-based H(A1) hash computed with the collision password will be identical to the one computed from the original non-Latin-1 password.
6. Gain unauthorized access: Submit the crafted request to the protected endpoint. The server's Digest authentication logic will accept the response as valid, granting access to the protected resource (GitHub Advisory, Jetty Advisory).

• Network: HTTP requests to Digest-authenticated endpoints with Authorization: Digest headers where the response hash matches a ?-substituted password pattern; repeated authentication attempts from a single IP against the same username with varying ?-character passwords of different lengths.
• Logs: Jetty access logs showing successful 200 OK responses to protected resources from IPs that have not previously authenticated; authentication success events immediately following a 401 Unauthorized challenge without a corresponding legitimate login flow.
• Behavioral: Successful access to protected resources by accounts whose passwords are known to contain non-Latin-1 characters, originating from unexpected geographic locations or IP addresses not associated with the legitimate user.

Upgrade Eclipse Jetty to a patched version: 9.4.63, 10.0.31, 11.0.31, 12.0.36, or 12.1.10 or later, which correct the ISO-8859-1 encoding issue in DigestAuthentication.java (GitHub Advisory, Jetty Advisory). As a temporary workaround if immediate upgrade is not possible, restrict Digest authentication to accounts whose passwords contain only ISO-8859-1 compatible characters (U+0000–U+00FF), eliminating the collision condition. For a more robust long-term alternative, consider replacing HTTP Digest authentication with HTTP Basic authentication over TLS or a modern authentication mechanism such as OAuth 2.0/OpenID Connect, which avoids the MD5-based hash collision risk entirely.

HeroDevs published a vulnerability directory entry and blog post covering CVE-2026-10050, providing additional context for organizations using Jetty in production environments (HeroDevs Blog). SUSE issued a security update (SUSE-SU-2026:3631-1) addressing the vulnerability in their distributions, and IBM i PTF guidance also referenced the issue in a security patch roundup (SUSE Advisory). Tenable released detection plugins (Nessus plugin 332072) for the vulnerability. Community discussion on LinkedIn and Bluesky noted the practical impact on non-European-language users who may be silently locked out of Digest-authenticated services.