Read the docs
TI-2026-08807 Aliases CVE-2026-10050GHSA-2fvj-hgj9-j2gr

Digest authentication lossy encoding

Priority HIGH 77CWE-173Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 17 fixed, 7 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00632 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.eclipse.jetty:jetty-security (Maven): 9.4.63, 10.0.31, 11.0.31 +2org.eclipse.jetty.ee8:jetty-ee8-security (Maven): 12.0.36, 12.1.10+1 more productRed Hat: 17 advisoriesRed Hat: 17 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty - EE812.0.0 – 12.0.35; 12.1.0 – 12.1.9—No fix listedCNA
Eclipse FoundationEclipse Jetty - EE912.0.0 – 12.0.35; 12.1.0 – 12.1.9—No fix listedCNA
Eclipse FoundationEclipse Jetty9.4.0 – 9.4.62; 10.0.0 – 10.0.30; 11.0.0 – 11.0.30; 12.0.0 – 12.0.35; 12.1.0 – 12.1.9—No fix listedCNA
—org.eclipse.jetty:jetty-security (Maven)9.4.0.v20161208 to before 9.4.639.4.63Patch availableGHSA-2fvj-hgj9-j2gr
—org.eclipse.jetty:jetty-security (Maven)10.0.0 to before 10.0.3110.0.31Patch availableGHSA-2fvj-hgj9-j2gr
—org.eclipse.jetty:jetty-security (Maven)11.0.0 to before 11.0.3111.0.31Patch availableGHSA-2fvj-hgj9-j2gr
—org.eclipse.jetty:jetty-security (Maven)12.0.0 to before 12.0.3612.0.36Patch availableGHSA-2fvj-hgj9-j2gr
—org.eclipse.jetty.ee8:jetty-ee8-security (Maven)12.0.0 to before 12.0.3612.0.36Patch availableGHSA-2fvj-hgj9-j2gr
—org.eclipse.jetty.ee9:jetty-ee9-security (Maven)12.0.0 to before 12.0.3612.0.36Patch availableGHSA-2fvj-hgj9-j2gr
—org.eclipse.jetty:jetty-security (Maven)12.1.0 to before 12.1.1012.1.10Patch availableGHSA-2fvj-hgj9-j2gr
—org.eclipse.jetty.ee8:jetty-ee8-security (Maven)12.1.0 to before 12.1.1012.1.10Patch availableGHSA-2fvj-hgj9-j2gr
—org.eclipse.jetty.ee9:jetty-ee9-security (Maven)12.1.0 to before 12.1.1012.1.10Patch availableGHSA-2fvj-hgj9-j2gr
  • Eclipse Jetty - EE8 VendorEclipse Foundation Affected 12.0.0 – 12.0.35; 12.1.0 – 12.1.9 Fixed in — No fix listed CNA
  • Eclipse Jetty - EE9 VendorEclipse Foundation Affected 12.0.0 – 12.0.35; 12.1.0 – 12.1.9 Fixed in — No fix listed CNA
  • Eclipse Jetty VendorEclipse Foundation Affected 9.4.0 – 9.4.62; 10.0.0 – 10.0.30; 11.0.0 – 11.0.30; 12.0.0 – 12.0.35; 12.1.0 – 12.1.9 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-security (Maven) Vendor— Affected 9.4.0.v20161208 to before 9.4.63 Fixed in 9.4.63 Patch available GHSA-2fvj-hgj9-j2gr
  • org.eclipse.jetty:jetty-security (Maven) Vendor— Affected 10.0.0 to before 10.0.31 Fixed in 10.0.31 Patch available GHSA-2fvj-hgj9-j2gr
  • org.eclipse.jetty:jetty-security (Maven) Vendor— Affected 11.0.0 to before 11.0.31 Fixed in 11.0.31 Patch available GHSA-2fvj-hgj9-j2gr
  • org.eclipse.jetty:jetty-security (Maven) Vendor— Affected 12.0.0 to before 12.0.36 Fixed in 12.0.36 Patch available GHSA-2fvj-hgj9-j2gr
  • org.eclipse.jetty.ee8:jetty-ee8-security (Maven) Vendor— Affected 12.0.0 to before 12.0.36 Fixed in 12.0.36 Patch available GHSA-2fvj-hgj9-j2gr
  • org.eclipse.jetty.ee9:jetty-ee9-security (Maven) Vendor— Affected 12.0.0 to before 12.0.36 Fixed in 12.0.36 Patch available GHSA-2fvj-hgj9-j2gr
  • org.eclipse.jetty:jetty-security (Maven) Vendor— Affected 12.1.0 to before 12.1.10 Fixed in 12.1.10 Patch available GHSA-2fvj-hgj9-j2gr
  • org.eclipse.jetty.ee8:jetty-ee8-security (Maven) Vendor— Affected 12.1.0 to before 12.1.10 Fixed in 12.1.10 Patch available GHSA-2fvj-hgj9-j2gr
  • org.eclipse.jetty.ee9:jetty-ee9-security (Maven) Vendor— Affected 12.1.0 to before 12.1.10 Fixed in 12.1.10 Patch available GHSA-2fvj-hgj9-j2gr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.4.0 to before 9.4.63; 10.0.0 to before 10.0.31; 11.0.0 to before 11.0.31; 12.0.0 to before 12.0.36; 12.1.0 to before 12.1.10VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.4.0 to before 9.4.63; 10.0.0 to before 10.0.31; 11.0.0 to before 11.0.31; 12.0.0 to before 12.0.36; 12.1.0 to before 12.1.10 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-2fvj-hgj9-j2gr org.eclipse.jetty:jetty-security (Maven) Fixed in 9.4.63 Advisory →
  • Fix · GHSA-2fvj-hgj9-j2gr org.eclipse.jetty:jetty-security (Maven) Fixed in 10.0.31 Advisory →
  • Fix · GHSA-2fvj-hgj9-j2gr org.eclipse.jetty:jetty-security (Maven) Fixed in 11.0.31 Advisory →
  • Fix · GHSA-2fvj-hgj9-j2gr org.eclipse.jetty:jetty-security (Maven) Fixed in 12.0.36 Advisory →
  • Fix · GHSA-2fvj-hgj9-j2gr org.eclipse.jetty.ee8:jetty-ee8-security (Maven) Fixed in 12.0.36 Advisory →
  • Fix · GHSA-2fvj-hgj9-j2gr org.eclipse.jetty.ee9:jetty-ee9-security (Maven) Fixed in 12.0.36 Advisory →
  • Fix · GHSA-2fvj-hgj9-j2gr org.eclipse.jetty:jetty-security (Maven) Fixed in 12.1.10 Advisory →
  • Fix · GHSA-2fvj-hgj9-j2gr org.eclipse.jetty.ee8:jetty-ee8-security (Maven) Fixed in 12.1.10 Advisory →
  • Fix · GHSA-2fvj-hgj9-j2gr org.eclipse.jetty.ee9:jetty-ee9-security (Maven) Fixed in 12.1.10 Advisory →

Red Hat 17 advisories

  • RHSA-2026:88159 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88158 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88157 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 14 more Red Hat advisories
  • RHSA-2026:88156 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88155 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88154 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88153 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88151 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88152 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88149 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88150 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83612 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Debezium 3.6.3 release
    • Red Hat Build of Debezium 3.6
  • RHSA-2026:71675 Released 2026-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix yet
streams for Apache Kafka 3AffectedNo fix planned: Will not fix
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:88152
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:88149
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:88151
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:88150
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:88156
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:88159
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:88153
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:88158
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:88157
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:88155
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:88154
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Build of Debezium 3.6Fixed RHSA-2026:83612
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16Fixed RHSA-2026:71675
Not affected: 22 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Apicurio Registry 3
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10050
  2. 2026-10-03 Alias added: GHSA-2fvj-hgj9-j2gr
  3. 2026-10-16 Fix available: RHSA-2026:83612 · Red Hat
  4. 2026-10-16 Fix available: Red Hat Build of Debezium 3.6 · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  6. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  7. 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
  8. 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
  9. 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
  10. 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
  18. 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat
  19. 2026-10-25 EPSS moved to the 50th–90th percentile
  20. 2026-11-03 Affected versions changed · Red Hat

References

Exploit 1

Other 9

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2024-14794 Jetty connection leaking on idle timeout when TCP congested CVSS 3.1HIGH 7.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences