Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-21 | 1 | Patch1 |
| 2026-08-04 | 1 | General1 |
CVE-2026-19032 CVE-2026-2332 CVE-2026-49844 CVE-2026-6790 CVE-2026-68497 CVE-2026-83557 N/A Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: CVE-2024-6763 CVE-2025-46392 CVE-2026-10050 CVE-2026-19032 CVE-2026-2332 CVE-2026-49844 8/16
CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-81870 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 N/A Security fixes for apigee-mart-server. This addresses the following vulnerabilities: CVE-2024-6763 CVE-2025-46392 CVE-2026-10050 7/16
CVE-2026-10050: Jetty Digest auth bypass. 8.7 High (CVSS v4). ISO-8859-1 collapses every character above U+00FF to "?" — so a collision password authenticates as the victim. Unauthenticated. No user interaction. Fixed in 12.0.36 / 12.1.10. EOL lines → NES for Jetty. #CVE #Jetty #AppSec
Post summary
The post announces a high‑severity Jetty Digest authentication bypass (CVE-2026-10050), details the ISO‑8859‑1 charset collision flaw, and notes that versions 12.0.36 and 12.1.10 contain the fix.
CVE-2026-10050 Digest Authentication Bypass in Eclipse Jetty via Character Encoding Mis... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-10050 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The tweet briefly announces CVE-2026-10050, describing it as a Digest authentication bypass in Eclipse Jetty, but provides no PoC, exploit, patch, or activity details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | eclipse | jetty | - | - | - |