Authentication bypass in Eclipse Jetty Digest Authentication via ISO-8859-1 encoding (CVE-2026-10050)

The `DigestAuthentication.apply()` method in Eclipse Jetty's HTTP client uses ISO-8859-1 encoding to compute Digest authentication response hashes, silently replacing any character above U+00FF with the byte `0x3F` (`?`). An attacker who knows a victim's username can authenticate as that user by substituting all non-Latin-1 characters in the password with `?`, as this produces an identical MD5-based Digest response hash. Users whose passwords contain non-Latin-1 characters (CJK, Cyrillic, Arabic, Greek, Hangul, emoji, etc.) are also unable to successfully authenticate via Digest auth, constituting an additional functional denial of service. Public POC available. Affected versions: - org.eclipse.jetty.ee8:jetty-ee8-security <=12.0.0, >=12.0.35 - org.eclipse.jetty.ee8:jetty-ee8-security >=12.1.0, <=12.1.9 - org.eclipse.jetty.ee9:jetty-ee9-security <=12.0.0, >=12.0.35 - org.eclipse.jetty.ee9:jetty-ee9-security >=12.1.0, <=12.1.9 - org.eclipse.jetty:jetty-security >= 9.4.0, <=9.4.62 - org.eclipse.jetty:jetty-security <=10.0.0, >=10.0.30 - org.eclipse.jetty:jetty-security <=11.0.0, >=11.0.30 - org.eclipse.jetty:jetty-security <=12.0.0, >=12.0.35 - org.eclipse.jetty:jetty-security >=12.1.0, <=12.1.9 We recommend updating to: 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10. CVSS ? · our assessment: this_week Reference: https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr Details: https://vuln.today/cve/CVE-2026-10050