CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

GHSA-2FVJ-HGJ9-J2GR Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...