CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

UBUNTU-CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-10050

Summary: CVE-2026-10050 affects Eclipse Jetty’s Digest authentication, where the server-side password encoding uses ISO-8859-1 by default. When characters cannot be represented in ISO-8859-1, they are replaced with “?”, enabling an attacker to submit a Digest header where a password of all “?” ch...

CVE-2026-10050 Digest authentication lossy encoding

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-10050 Digest authentication lossy encoding

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-10050 Digest authentication lossy encoding

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

com.google.appengine:jetty12-assembly (>=2.0.20, <=3.0.3), com.sap.cloud.security:java-security-test (3.3.2) +58 more potentially affected by CVE-2026-10050 via org.eclipse.jetty.ee9:jetty-ee9-security (>=12.0.0, <=12.0.35)

org.eclipse.jetty.ee9:jetty-ee9-security MAVEN version =12.0.0, =2.0.20, =1887.v9e47623cb043, =2.3.0, =2.4.0, =1.0.4, =2.18.0, =3.0.0.beta7 - org.aksw.jenax:jenax-fsrdfstore-system 5.0.0-1 - org.aksw.jenax:jenax-server-core 5.0.0-1 - org.aksw.jenax:jenax-server-frontends 5.0.0-1 -...

com.ascentstream.pulsar:pulsar-bookkeeper-prometheus-metrics-provider (4.0.11.0), com.ascentstream.pulsar:pulsar-broker (4.0.11.0) +88 more potentially affected by CVE-2026-10050 via org.eclipse.jetty.ee8:jetty-ee8-security (>=12.1.0, <=12.1.9)

org.eclipse.jetty.ee8:jetty-ee8-security MAVEN version =12.1.0, =5.0.1, =5.0.3-beta and more Source cves: CVE-2026-10050 Source advisory: MEND:CVE-2026-10050...

ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2), ca.ibodrov.concord:repository-browser-plugin (>=1.0.0, <=1.0.1) +228 more potentially affected by CVE-2026-10050 via org.eclipse.jetty.ee8:jetty-ee8-security (>=12.0.0, <=12.0.35)

org.eclipse.jetty.ee8:jetty-ee8-security MAVEN version =12.0.0, =0.0.1, =1.0.0, =2.0.3, =0.0.27, =0.0.22, =0.0.27, =2.6.0-rc1, =3.4.0, =2.0.20, =2.0.20, =2.0.20, =2.0.20, =2.0.20, =1.0.0, =2.11.0, =2.44.0 and more Source cves: CVE-2026-10050 Source advisory: MEND:CVE-2026-10050...

CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

com.google.appengine:appengine-java-sdk (>=5.0.0, <=5.0.3-beta), com.google.appengine:jetty121-assembly (>=3.0.0-beta, <=5.0.3-beta) +32 more potentially affected by CVE-2026-10050 via org.eclipse.jetty.ee9:jetty-ee9-security (>=12.1.0, <=12.1.9)

org.eclipse.jetty.ee9:jetty-ee9-security MAVEN version =12.1.0, =5.0.0, =3.0.0-beta, =2006.v001a2ca6b574, =2.43.0, =2.43.0, =2.43.0, =2.43.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =12.1.0, =12.1.0, =12.1.0, =12.1.9 and more Source cves: CVE-2026-10050 Source advisory: MEND:CVE-2026-10050...

Linux Distros Unpatched Vulnerability : CVE-2026-10050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specificati...

CVE-2026-10050: Improper Handling of Alternate Encoding

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68981

The CVE-2026-68981 issue affects Apache NiFi versions 1.5.0 through 2.10.0, where gzip-encoded HTTP requests to the REST API are processed via a Jersey encoding filter. A configurable maximum is enforced on the compressed payload rather than the decompressed output, which could allow a malicious ...

EUVD-2026-52423

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses...