Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Jetty Improper Handling of Alternate Encoding Vulnerability - CVE-2026-10050 - Vulnerability Database
Jetty

Jetty Improper Handling of Alternate Encoding Vulnerability - CVE-2026-10050

Critical
Reference: CVE-2026-10050
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-10050
Title: Jetty Improper Handling of Alternate Encoding Vulnerability
Overview:

In Eclipse Jetty the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1 they are silently replaced by . This happens with passwords that contain Chinese Cyrillic or Greek characters for example: 123 converts to 123. An attacker can send a request with a digest Authorization header crafted with a password made of only characters the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest RFC-7616(https://datatracker.ietf.org/doc/html/rfc7616) supports a charset parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.