Eclipse Jetty CVE-2026-10050

Exploitation requires three concurrent conditions: (1) the target application must use HTTP Digest Authentication - Basic auth, Bearer tokens, or any non-Digest scheme are not affected; (2) the targeted user account must have at least one password character with a Unicode code point above U+00FF, which covers all CJK (U+4E00-U+9FFF), Hangul (U+AC00-U+D7AF), Cyrillic (U+0400-U+04FF), Arabic (U+0600-U+06FF), Greek extended (U+0370-U+03FF), and many accented Latin characters (U+0100-U+024F); and (3) the attacker must know the target account's username. Exploitation is limited by: accounts with purely ASCII or Latin-1 passwords (U+0000-U+00FF) are not vulnerable to the collision attack; the attacker must correctly identify which non-Latin-1 characters appear in the password to construct the collision, though any '?' substitution across all positions is sufficient; and services enforcing account lockout policies may impede trial-and-error username enumeration. The secondary DoS impact (legitimate users unable to authenticate) requires only that the user has a non-Latin-1 password and the server computes hashes with UTF-8 while Jetty's client computes with ISO-8859-1.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N reflects a worst-case scenario: network-exploitable, no complexity barriers, no privileges needed, high confidentiality impact. The PR:N is meaningful here - an attacker submitting Digest credentials does not need any pre-existing access, only the target username, which is often observable from application logs, directory services, or API responses. The AC:L rating is defensible because the attack is deterministic once the attacker knows which characters to replace; no brute-forcing or timing attacks are required. Critically, the attack is limited to accounts whose passwords contain at least one character above U+00FF, which is common in applications serving non-European users but rare in purely ASCII-password environments. The official CVSS 4.0 vector omits availability impact (VA:N), but a secondary DoS vector exists: legitimate users with non-Latin-1 passwords will permanently fail authentication because the client-computed hash will not match a server storing UTF-8-derived hashes. This discrepancy between the CVSS vector and the described availability impact should be flagged for remediation prioritization. A publicly available PoC (including hash collision demonstrations across four scripts) lowers the bar for exploitation significantly, but no CISA KEV listing exists, suggesting targeted rather than opportunistic exploitation at this time. Real-world risk is highest for applications serving Asian, Eastern European, or Arabic-language user bases with Digest auth enabled.

An attacker targeting a Jetty-based application with Digest auth discovers the username 'li.wei@corp.example' through a publicly visible API or directory listing; knowing the application serves Chinese-language users, they guess the password likely contains CJK characters. The attacker submits a Digest auth response computed using a collision password where all CJK characters are replaced with '?', producing a byte-for-byte identical MD5 hash under ISO-8859-1 encoding. The server's Digest validator, using the same lossy encoding, computes the same hash and grants access - requiring no knowledge of the original password. A publicly available PoC demonstrates this collision deterministically across Chinese, Korean, Cyrillic, and Greek password patterns.