CVE-2026-10050 is a critical (CVSS 9.1) authentication flaw in Eclipse Jetty's Digest authentication. Passwords with characters outside ISO-8859-1 are silently turned into question marks, so a crafted guess can match. The GitHub advisory lists fixed releases 9.4.63, 10.0.31, 11.0.31, 12.0.36 and 12.1.10. Upgrade, then review where you use Digest.
What's affected
The GitHub advisory lists these ranges for the org.eclipse.jetty:jetty-security artifact, with the matching fixed release:
| Affected | Fixed |
|---|---|
| 9.4.0 through 9.4.62 | 9.4.63 |
| 10.0.0 through 10.0.30 | 10.0.31 |
| 11.0.0 through 11.0.30 | 11.0.31 |
| 12.0.0 through 12.0.35 | 12.0.36 |
| 12.1.0 through 12.1.9 | 12.1.10 |
The jetty-ee8-security and jetty-ee9-security artifacts share the 12.0.0 through 12.0.35 and 12.1.0 through 12.1.9 ranges, fixed in 12.0.36 and 12.1.10.
One wrinkle: the NVD text describes the server side Digest component, while the advisory body walks through the Digest code in Jetty's HTTP client. Treat both as in scope until you have read the advisory yourself.
How to check if you're exposed
Find which Jetty artifacts you ship:
mvn dependency:tree -Dincludes=org.eclipse.jetty
gradle dependencies --configuration runtimeClasspath | grep -i jetty
If you embed Jetty, also check for Digest authentication in your security configuration. Search for DIGEST in web.xml and in any code that builds a DigestAuthenticator. If you never use Digest, your practical exposure is lower, but you should still move to a fixed release.
What to do now
- Upgrade Jetty to the fixed release for your line: 9.4.63, 10.0.31, 11.0.31, 12.0.36 or 12.1.10.
- Where you can, move from Digest to a stronger scheme such as TLS with a modern credential flow.
- Review accounts whose passwords contain Chinese, Cyrillic, Greek or other non-Latin-1 characters, since those are the ones affected by the lossy encoding. Consider rotating them after the upgrade.
- Read the GitHub advisory for any mitigation notes that apply to your deployment.
- Rescan your build so the old version no longer shows up in any image or fat jar.
Why it matters
The root problem is an encoding mismatch. Jetty converted the password to bytes using ISO-8859-1, a character set that cannot represent most of the world's scripts. Anything it cannot represent becomes a question mark. Two different passwords of the same length can then produce the same digest input.
That maps to CWE-173 (handling of alternate encodings) and CWE-303 (an incorrect implementation of an authentication algorithm). The record rates it 9.1, network reachable, no privileges and no user interaction. RFC 7616 added a charset parameter that defaults to UTF-8, which is the correct way to encode these passwords.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect users whose passwords are plain ASCII?
The description centres on passwords containing characters that cannot be represented in ISO-8859-1. Passwords made only of ASCII characters do not hit the lossy replacement. You should still upgrade, because the weakness is in the library.
Sources
Last reviewed: 19 October 2026.
