CVE catalog

CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitl

[CVE catalog]

Severity
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.63% · Oct 25, 2026

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjetty9sid9.4.58-2vulnerable
Debianjetty9forky9.4.58-2vulnerable
Debianjetty9trixie9.4.57-1.1~deb13u1vulnerable
Debianjetty9trixie-security9.4.57-1.1~deb13u1vulnerable
Debianjetty9bookworm9.4.57-1.1~deb12u1vulnerable
Debianjetty9bookworm-security9.4.57-1.1~deb12u1vulnerable
Mavenorg.eclipse.jetty:jetty-securityNot reported12.1.10fixed
Mavenorg.eclipse.jetty:jetty-securityNot reported10.0.31fixed
Mavenorg.eclipse.jetty:jetty-securityNot reported11.0.31fixed
Mavenorg.eclipse.jetty:jetty-securityNot reported12.0.36fixed
Mavenorg.eclipse.jetty.ee8:jetty-ee8-securityNot reported12.1.10fixed
Mavenorg.eclipse.jetty.ee9:jetty-ee9-securityNot reported12.1.10fixed
Mavenorg.eclipse.jetty:jetty-securityNot reported12.1.10fixed
Mavenorg.eclipse.jetty.ee8:jetty-ee8-securityNot reported12.1.10fixed
Mavenorg.eclipse.jetty.ee9:jetty-ee9-securityNot reported12.1.10fixed
Susejetty-minimallinux enterprise module for development tools 15 sp79.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise module for package hub 15 sp79.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise high performance computing 15 sp4-espos9.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise high performance computing 15 sp4-ltss9.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise high performance computing 15 sp5-espos9.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise high performance computing 15 sp5-ltss9.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise server 15 sp4-ltss9.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise server 15 sp5-ltss9.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise server 15 sp6-ltss9.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise server for sap applications 15 sp49.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise server for sap applications 15 sp59.4.58-150200.3.43.1fixed
Susejetty-minimallinux enterprise server for sap applications 15 sp69.4.58-150200.3.43.1fixed
Opensusejetty-minimaltumbleweed9.4.58-5.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjetty9sourcesid(unfixed)not yet assignedNot reported[1151846]
Debianjetty9sourceforky(unfixed)not yet assignedNot reported[1151846]
Debianjetty9sourcetrixie(unfixed)not yet assignedNot reported[1151846]
Debianjetty9sourcebookworm(unfixed)not yet assignedNot reported[1151846]
Mavenorg.eclipse.jetty:jetty-securitymavenNot reported12.1.10Not reportedGHSA-2FVJ-HGJ9-J2GRNot reported
Mavenorg.eclipse.jetty:jetty-securitymavenNot reported10.0.31Not reportedNot reportedNot reported
Mavenorg.eclipse.jetty:jetty-securitymavenNot reported11.0.31Not reportedNot reportedNot reported
Mavenorg.eclipse.jetty:jetty-securitymavenNot reported12.0.36Not reportedNot reportedNot reported
Mavenorg.eclipse.jetty.ee8:jetty-ee8-securitymavenNot reported12.1.10Not reportedGHSA-2FVJ-HGJ9-J2GRNot reported
Mavenorg.eclipse.jetty.ee9:jetty-ee9-securitymavenNot reported12.1.10Not reportedGHSA-2FVJ-HGJ9-J2GRNot reported
Mavenorg.eclipse.jetty:jetty-securitymavenNot reported12.1.10Not reportedNot reportedNot reported
Mavenorg.eclipse.jetty.ee8:jetty-ee8-securitymavenNot reported12.1.10Not reportedNot reportedNot reported
Mavenorg.eclipse.jetty.ee9:jetty-ee9-securitymavenNot reported12.1.10Not reportedNot reportedNot reported
Susejetty-minimalrpmlinux enterprise module for development tools 15 sp79.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise module for package hub 15 sp79.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise high performance computing 15 sp4-espos9.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise high performance computing 15 sp4-ltss9.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise high performance computing 15 sp5-espos9.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise high performance computing 15 sp5-ltss9.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise server 15 sp4-ltss9.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise server 15 sp5-ltss9.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise server 15 sp6-ltss9.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise server for sap applications 15 sp49.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise server for sap applications 15 sp59.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Susejetty-minimalrpmlinux enterprise server for sap applications 15 sp69.4.58-150200.3.43.1Not reportedSUSE-SU-2026:3631-1Not reported
Opensusejetty-minimalrpmtumbleweed9.4.58-5.1Not reportedOPENSUSE-SU-2026:11505-1Not reported

[Debian bug #1151846]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [jetty9]Affected
    Details (4)

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

  • [libjetty9-extra-java]Affected

    Source package: [jetty9]

    Details (4)

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

  • [libjetty9-java]Affected

    Source package: [jetty9]

    Details (4)

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

[Debian 13 (Trixie)]

  • [jetty12]Affected
    Details (4)

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

  • [jetty9]Affected
    Details (4)

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

  • [libjetty12-extra-java]Affected

    Source package: [jetty12]

    Details (4)

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

  • [libjetty12-java]Affected

    Source package: [jetty12]

    Details (4)

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

  • [libjetty9-extra-java]Affected

    Source package: [jetty9]

    Details (4)

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

  • [libjetty9-java]Affected

    Source package: [jetty9]

    Details (4)

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

[openSUSE Tumbleweed]

  • [jetty-annotations]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-ant]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-cdi]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-client]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-continuation]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-deploy]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-fcgi]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-http]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-http-spi]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-io]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-jaas]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-5.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]