{"id":"GHSA-2fvj-hgj9-j2gr","summary":"Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution","details":"### Summary\nThe `DigestAuthentication.apply()` method in Jetty's HTTP client uses `getBytes(StandardCharsets.ISO_8859_1)` at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emoji, etc.) with 0x3F (`?`), causing all such characters to produce identical hash contributions. An attacker who knows a victim's username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with `?` characters, since the collision password produces the same MD5-based Digest response hash as the original password.\n\n### Details\n### Root Cause\n\nIn `jetty-core/jetty-client/src/main/java/org/eclipse/jetty/client/DigestAuthentication.java`, the `apply()` method computes the three Digest auth hashes (H(A1), H(A2), and the final response) using ISO-8859-1 character encoding:\n\n```java\n// Line 171 — H(A1)\nString hashA1 = toHexString(digester.digest(a1.getBytes(StandardCharsets.ISO_8859_1)));\n\n// Line 179 — H(A2)\nString hashA2 = toHexString(digester.digest(a2.getBytes(StandardCharsets.ISO_8859_1)));\n\n// Line 196 — Final response hash\nfinal String hashA3 = toHexString(digester.digest(a3.getBytes(StandardCharsets.ISO_8859_1)));\n```\n\nISO-8859-1 (Latin-1) can only encode characters in the range U+0000–U+00FF. Any character outside this range — including all CJK, Cyrillic, Arabic, Greek, Hangul, and emoji characters — is silently replaced with the byte `0x3F` (`?`). `String.getBytes(ISO_8859_1)` in Java performs this replacement without any warning or exception.\n\n### PoC\n```\nPassword: \"我爱Java!密码123★\" (7 non-Latin-1 characters)\n\nUTF-8 encoding:    45 bytes → MD5 H(A1) = 9a4e61484f228633d5d0f95d1bbb0a99\nISO-8859-1:        31 bytes → MD5 H(A1) = d60ddc903d71913bcc3ab4a94f7fc239\nCollision \"??...\": 31 bytes → MD5 H(A1) = d60ddc903d71913bcc3ab4a94f7fc239 ← IDENTICAL\n```\n\nMulti-language confirmation — all four language passwords below produce the same hash:\n\n```\nChinese (密码123)  → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nKorean  (비번123)  → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nCyrillic(аб123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nGreek   (αβ123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nAttacker(??123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560 ← all collide!\n```\n\n### Impact\n**Scenario 1: Authentication Bypass (Collision Attack)**\n\nIf a service using Jetty for Digest authentication has a user with a non-Latin-1 password (e.g., Chinese, Japanese, Russian), an attacker can authenticate as that user using a collision password where all non-Latin-1 characters are replaced with `?`:\n\n- Original password: `我爱Java!密码123★`\n- Collision password: `??Java!??123?`\n- **Both produce identical MD5 hashes under ISO-8859-1** → Authentication succeeds\n\nThis affects any password containing characters \u003e U+00FF, which covers:\n- Chinese (CJK): U+4E00–U+9FFF\n- Japanese (Hiragana/Katakana/Kanji): U+3040–U+30FF, U+4E00+\n- Korean (Hangul): U+AC00–U+D7AF\n- Cyrillic: U+0400–U+04FF (Russian, Ukrainian, Bulgarian, etc.)\n- Arabic: U+0600–U+06FF\n- Greek: U+0370–U+03FF\n- Latin Extended: U+0100–U+024F (accented European characters like ĉ, ğ, ñ when \u003e U+00FF)\n- Emoji / Symbols \u003e U+00FF\n\n**Scenario 2: Denial of Service for Non-Latin-1 Users**\n\nMost modern web applications store password hashes computed using UTF-8. When Jetty's Digest client computes a hash with ISO-8859-1, the bytes differ from what the server stored/expects. This means **any user with non-ASCII (Latin-1+) characters in their password can never successfully authenticate via Digest auth** — even the legitimate user. This is not just a security issue but a functional correctness bug that silently breaks authentication for most non-European-language users.","aliases":["CVE-2026-10050"],"modified":"2026-07-22T23:25:41.093162Z","published":"2026-07-22T22:55:18Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-07-22T22:55:18Z","nvd_published_at":null,"cwe_ids":["CWE-173","CWE-303"]},"references":[{"type":"WEB","url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/issues/15136"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/pull/15160"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/pull/15183"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d"},{"type":"PACKAGE","url":"https://github.com/jetty/jetty.project"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10"}],"affected":[{"package":{"name":"org.eclipse.jetty:jetty-security","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0.v20161208"},{"fixed":"9.4.63"}]}],"versions":["9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.53.v20231009","9.4.54.v20240208","9.4.55.v20240627","9.4.56.v20240826","9.4.57.v20241219","9.4.58.v20250814","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"],"database_specific":{"last_known_affected_version_range":"\u003c= 9.4.58.v20250814","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"}},{"package":{"name":"org.eclipse.jetty:jetty-security","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.31"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.26","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json","last_known_affected_version_range":"\u003c= 10.0.26"}},{"package":{"name":"org.eclipse.jetty:jetty-security","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.31"}]}],"versions":["11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.2","11.0.20","11.0.21","11.0.22","11.0.23","11.0.24","11.0.25","11.0.26","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 11.0.26","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"}},{"package":{"name":"org.eclipse.jetty:jetty-security","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.36"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.34","12.0.35","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 12.0.35","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"}},{"package":{"name":"org.eclipse.jetty.ee8:jetty-ee8-security","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.36"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.34","12.0.35","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 12.0.35","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"}},{"package":{"name":"org.eclipse.jetty.ee9:jetty-ee9-security","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.36"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.34","12.0.35","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 12.0.35","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"}},{"package":{"name":"org.eclipse.jetty:jetty-security","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.10"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.1.8","12.1.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 12.1.9","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"}},{"package":{"name":"org.eclipse.jetty.ee8:jetty-ee8-security","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.10"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.1.8","12.1.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 12.1.9","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"}},{"package":{"name":"org.eclipse.jetty.ee9:jetty-ee9-security","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.10"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.1.8","12.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json","last_known_affected_version_range":"\u003c= 12.1.9"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}