CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-10050 Digest authentication lossy encoding

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-10050

Summary: CVE-2026-10050 affects Eclipse Jetty’s Digest authentication, where the server-side password encoding uses ISO-8859-1 by default. When characters cannot be represented in ISO-8859-1, they are replaced with “?”, enabling an attacker to submit a Digest header where a password of all “?” ch...

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...

GHSA-2FVJ-HGJ9-J2GR Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...

PT-2026-63532

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description The Digest authentication server-side component and the DigestAuthentication.apply method in the HTTP client use ISO-8859-1 encoding to process passwords. Because ISO-8859-1 cannot...

CVE-2026-8859

creationtimestamp| type| source ---|---|--- 2026-07-17 20:28:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqulmi3kxg2e 2026-07-17 22:31:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqusj4xzp62g 2026-07-18 12:00:55+00:00| seen|...

CVE-2026-8859

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enabled, where filenames extracted from HT...

GHSA-7FPX-M38W-8859 vulnerabilities

Vulnerabilities for packages: chromium...

Oracle Linux 8 : vim (ELSA-2026-28553)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-28553 advisory. 8.0.1763-24.0.1 - Remove upstream references Orabug: 31197557 - Added glibc-gconv-extra to common requires to provide ISO-8859-2 Orabug: 34114984 2:8.0.1763-24...

CVE-2026-7259

A flaw was found in PHP. When an attacker input can influence the encoding passed to mbregexencoding and the application subsequently uses mbregex search APIs, a NULL pointer dereference can occur due to a mismatch between the Oniguruma and mbfl encoding support. This issue can cause a crash in t...

RHEL 9 : giflib (RHSA-2026:8859)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8859 advisory. giflib is a library for reading and writing gif images. Security Fixes: giflib: Giflib: Double-free vulnerability leading to memory corruption...

vim security update

8.0.1763-22.0.1 - Remove upstream references Orabug: 31197557 - Added glibc-gconv-extra to common requires to provide ISO-8859-2 Orabug: 34114984 2:8.0.1763-22 - RHEL-147935 CVE-2026-25749 vim: Heap Overflow in Vim...

vim security update

8.0.1763-21.0.1 - Remove upstream references Orabug: 31197557 - Added glibc-gconv-extra to common requires to provide ISO-8859-2 Orabug: 34114984 2:8.0.1763-21 - RHEL-112003 CVE-2025-53905 vim: Vim path traversial - RHEL-112007 CVE-2025-53906 vim: Vim path traversal 2:8.0.1763-20 - fix issue...

EUVD-2014-2988

Malware in sbrugna...

EUVD-2004-1762

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2020-8859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.4-283534d...

Linux Distros Unpatched Vulnerability : CVE-2015-8859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors. CVE-2015-8859 Note that Nessus relies on the presen...