Ghostwire

CVE-2026-10050: Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

HIGH CVSS 0.0 Exploit Available

Published: July 22, 2026 | Last Modified: July 22, 2026

Description

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Ghostwire Analysis — What This Means Practically

Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References

github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr
github.com/jetty/jetty.project/issues/15136
github.com/jetty/jetty.project/pull/15160
github.com/jetty/jetty.project/pull/15183
github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d
github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d
github.com/jetty/jetty.project/releases/tag/jetty-12.0.36
github.com/jetty/jetty.project/releases/tag/jetty-12.1.10
github.com/advisories/GHSA-2fvj-hgj9-j2gr
www.tenable.com/cve/CVE-2026-10050
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-10050