Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-10050— Digest authentication lossy encoding

Quick assessment

Affected
Eclipse Foundation Eclipse Jetty - EE8
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Eclipse Jetty是美国Eclipse基金会开源的一个Web应用服务器。 Eclipse Jetty存在输入验证错误漏洞，该漏洞源于HTTP规范并未明确指定字符集。

CVSS 8.7 · High EPSS 0.63% · P48

Affected Version Matrix 9

VendorProduct Version RangeStatus
Eclipse Foundation Eclipse Jetty 9.4.0≤ 9.4.62 affected
10.0.0≤ 10.0.30 affected
11.0.0≤ 11.0.30 affected
12.0.0≤ 12.0.35 affected
12.1.0≤ 12.1.9 affected
Eclipse Foundation Eclipse Jetty - EE8 12.0.0≤ 12.0.35 affected
12.1.0≤ 12.1.9 affected
Eclipse Foundation Eclipse Jetty - EE9 12.0.0≤ 12.0.35 affected
12.1.0≤ 12.1.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-10050

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Digest authentication lossy encoding
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
候选编码方案处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Eclipse Jetty 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Eclipse Jetty是美国Eclipse基金会开源的一个Web应用服务器。 Eclipse Jetty存在输入验证错误漏洞，该漏洞源于HTTP规范并未明确指定字符集。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse Jetty - EE8 12.0.0 ~ 12.0.35 -
Eclipse Foundation Eclipse Jetty - EE9 12.0.0 ~ 12.0.35 -
Eclipse Foundation Eclipse Jetty 9.4.0 ~ 9.4.62 -

II. Public POCs for CVE-2026-10050

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
default-local-qwen3.6 · 11929 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-10050

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-10050 (1)

Vendor Advisories for CVE-2026-10050 (1)

Same Patch Batch · Eclipse Foundation · 2026-08-04 · 7 CVEs total

CVE-2026-60007 9.1 CRITICAL Eclipse Milo 信息泄露漏洞
CVE-2026-58080 8.8 HIGH Eclipse Milo 授权问题漏洞
CVE-2026-62927 8.7 HIGH Eclipse Milo 授权问题漏洞
CVE-2026-63252 8.7 HIGH Eclipse Milo 资源管理错误漏洞
CVE-2026-63248 6.9 MEDIUM Eclipse Milo 授权问题漏洞
CVE-2026-61387 6.9 MEDIUM Eclipse Milo 资源管理错误漏洞

IV. Related Vulnerabilities

Same vendor: Eclipse Foundation
Same weakness: CWE-173

V. Comments for CVE-2026-10050

No comments yet

Leave a comment