{"id":"CVE-2026-10050","aliases":["CLSA-2026-1787793636","CLSA-2026-1787864241","CLSA-2026-1789159265","CLSA-2026-1789219285","CLSA-2026-1793132217","CLSA-2026-1793136455","CLSA-2026-1793144469","CLSA-2026-1793147482","CLSA-2026-1793150376","CLSA-2026-1794165486","CLSA-2026-1794247837","DEBIAN-CVE-2026-10050","EUVD-2026-52656","GHSA-2fvj-hgj9-j2gr","ROOT-APP-MAVEN-CVE-2026-10050","SUSE-SU-2026:3631-1","UBUNTU-CVE-2026-10050","openSUSE-SU-2026:11505-1"],"status":"published","title":"Digest authentication lossy encoding","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00632,"percentile":0.50595,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-173","CWE-303"],"published":"2026-07-22T22:55:18Z","modified":"2026-11-10T01:15:02Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","fixed_in":["9.4.63","10.0.31","11.0.31","12.0.36","12.1.10"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-security","fixed_in":["12.0.36","12.1.10"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-security","fixed_in":["12.0.36","12.1.10"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","fixed_in":["9.4.63.tuxcare0001","10.0.31.tuxcare0001","11.0.31.tuxcare0001","11.0.27.tuxcare0005","11.0.28.tuxcare0005","11.0.29.tuxcare0004","11.0.19-tuxcare.5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty12","fixed_in":["12.0.39-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.eclipse.jetty:jetty-security","fixed_in":["12.0.17-aikido.1","12.1.7-aikido.1","12.0.33-aikido.1","12.0.33-aikido.2","12.0.13-aikido.10","12.0.16-aikido.5","12.0.3-aikido.9","12.0.33-aikido.3","9.4.57.v20241219-aikido.5","11.0.26-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty:jetty-security","fixed_in":["12.0.17-root.io.1","12.1.7-root.io.1","12.0.33-root.io.1","12.0.33-root.io.2","12.0.13-root.io.10","12.0.16-root.io.5","12.0.3-root.io.9","12.0.33-root.io.3","9.4.57.v20241219-root.io.5","11.0.26-root.io.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.43.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"jetty-minimal","fixed_in":["9.4.58-5.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0.v20161208"},{"last_affected":"9.4.58.v20250814"},{"fixed":"9.4.63"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"10.0.26"},{"fixed":"10.0.31"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"11.0.26"},{"fixed":"11.0.31"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.35"},{"fixed":"12.0.36"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.35"},{"fixed":"12.0.36"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.35"},{"fixed":"12.0.36"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.9"},{"fixed":"12.1.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.9"},{"fixed":"12.1.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.9"},{"fixed":"12.1.10"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.63"},{"fixed":"9.4.63.tuxcare0001"}]}],"versions":["9.4.63"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.31"},{"fixed":"10.0.31.tuxcare0001"}]}],"versions":["10.0.31"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.31"},{"fixed":"11.0.31.tuxcare0001"}]}],"versions":["11.0.31"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-async-rest-jar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-async-rest-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-async-rest-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-async-rest-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-container-initializer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-jaas-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-jetty-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-jndi-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-jsp-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-mock-resources","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-proxy-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-simple-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-spec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-spec-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demo-web-fragment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demos-jetty-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.demos:demos-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.documentation:code-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.documentation:documentation-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.documentation:jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.fcgi:fcgi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.fcgi:fcgi-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.fcgi:fcgi-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.gcloud:gcloud-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.gcloud:jetty-gcloud-session-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-hpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-http-client-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http3:http3-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http3:http3-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http3:http3-http-client-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http3:http3-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http3:http3-qpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http3:http3-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.memcached:jetty-memcached-sessions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.memcached:memcached-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.osgi:jetty-httpservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.osgi:jetty-osgi-alpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.osgi:jetty-osgi-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.osgi:jetty-osgi-boot-jsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.osgi:jetty-osgi-boot-warurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.osgi:jetty-osgi-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.osgi:test-jetty-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.quic:quic-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.quic:quic-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.quic:quic-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.quic:quic-quiche","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.quic:quic-quiche-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.quic:quic-quiche-foreign-incubator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.quic:quic-quiche-jna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.quic:quic-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-core-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-core-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-jakarta-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-jakarta-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-jakarta-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-jetty-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-jetty-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-jetty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:apache-jsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:glassfish-jstl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:infinispan-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:infinispan-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:infinispan-embedded-query","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:infinispan-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:infinispan-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:infinispan-remote-query","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-alpn-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-alpn-conscrypt-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-alpn-conscrypt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-alpn-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-alpn-java-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-alpn-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-alpn-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-deploy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-home","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http-spi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jndi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jspc-maven-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-keystore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-maven-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-nosql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-p2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-quickstart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-rewrite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-servlets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-slf4j-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-start","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-unixdomain-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-unixsocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-unixsocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-unixsocket-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-unixsocket-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-util-ajax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.32"},{"fixed":"11.0.32.tuxcare0001"}]}],"versions":["11.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.26"},{"fixed":"11.0.26-tuxcare.3"}]}],"versions":["11.0.26","11.0.26-tuxcare.1","11.0.26-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.26"},{"fixed":"11.0.26-tuxcare.3"}]}],"versions":["11.0.26","11.0.26-tuxcare.1","11.0.26-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.27"},{"fixed":"11.0.27.tuxcare0005"}]}],"versions":["11.0.27","11.0.27.tuxcare00001","11.0.27.tuxcare0002","11.0.27.tuxcare0003","11.0.27.tuxcare0004"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.28"},{"fixed":"11.0.28.tuxcare0005"}]}],"versions":["11.0.28","11.0.28-tuxcare.2","11.0.28.tuxcare0001","11.0.28.tuxcare0003","11.0.28.tuxcare0004"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.29"},{"fixed":"11.0.29.tuxcare0004"}]}],"versions":["11.0.29","11.0.29.tuxcare0001","11.0.29.tuxcare0002","11.0.29.tuxcare0003"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.5"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2","11.0.19-tuxcare.3","11.0.19-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.2"}]}],"versions":["11.0.18","11.0.18-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.2"}]}],"versions":["11.0.18","11.0.18-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1","12.0.39-1","12.0.40-1","12.0.40-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.39-1"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.50-4","9.4.50-4+deb12u1","9.4.50-4+deb12u2","9.4.50-4+deb12u3","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb12u1","9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0.v20161208"},{"fixed":"9.4.63"}]}],"versions":["9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.53.v20231009","9.4.54.v20240208","9.4.55.v20240627","9.4.56.v20240826","9.4.57.v20241219","9.4.58.v20250814","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.31"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.26","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.31"}]}],"versions":["11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.2","11.0.20","11.0.21","11.0.22","11.0.23","11.0.24","11.0.25","11.0.26","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.36"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.34","12.0.35","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.36"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.34","12.0.35","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.36"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.34","12.0.35","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.10"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.1.8","12.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.10"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.1.8","12.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.10"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.1.8","12.1.9"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.17-aikido.1"},{"fixed":"12.1.7-aikido.1"},{"fixed":"12.0.33-aikido.1"},{"fixed":"12.0.33-aikido.2"},{"fixed":"12.0.13-aikido.10"},{"fixed":"12.0.16-aikido.5"},{"fixed":"12.0.3-aikido.9"},{"fixed":"12.0.33-aikido.3"},{"fixed":"9.4.57.v20241219-aikido.5"},{"fixed":"11.0.26-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.17-root.io.1"},{"fixed":"12.1.7-root.io.1"},{"fixed":"12.0.33-root.io.1"},{"fixed":"12.0.33-root.io.2"},{"fixed":"12.0.13-root.io.10"},{"fixed":"12.0.16-root.io.5"},{"fixed":"12.0.3-root.io.9"},{"fixed":"12.0.33-root.io.3"},{"fixed":"9.4.57.v20241219-root.io.5"},{"fixed":"11.0.26-root.io.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.43.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3.1","12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.58-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-5.1"}]}]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty - ee8"},{"vendor":"eclipse foundation","product":"eclipse jetty - ee9"}],"references":[{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","tags":["exploit","Vendor Advisory","Exploit","advisory","web","report"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120","tags":["Issue Tracking","web","report"]},{"url":"https://github.com/jetty/jetty.project/issues/15136","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/pull/15160","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/pull/15183","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2fvj-hgj9-j2gr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10050.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10050","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-10050","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263631-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272393","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10050","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-10050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10050","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-10050","title":"Digest authentication lossy encoding","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.","status":"published","published":"2026-08-04T11:02:40.503Z","modified":"2026-08-04T12:46:38.77Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-173","CWE-303"],"updated_at":"2026-11-02T13:40:12.486331Z"}],"euvd":[{"id":"EUVD-2026-52656","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.","status":"published","published":"2026-08-04T11:02:40Z","modified":"2026-08-04T12:46:38Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:23.332335Z"}],"ghsa":[{"id":"GHSA-2fvj-hgj9-j2gr","title":"Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution","description":"### Summary\nThe `DigestAuthentication.apply()` method in Jetty's HTTP client uses `getBytes(StandardCharsets.ISO_8859_1)` at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emoji, etc.) with 0x3F (`?`), causing all such characters to produce identical hash contributions. An attacker who knows a victim's username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with `?` characters, since the collision password produces the same MD5-based Digest response hash as the original password.\n\n### Details\n### Root Cause\n\nIn `jetty-core/jetty-client/src/main/java/org/eclipse/jetty/client/DigestAuthentication.java`, the `apply()` method computes the three Digest auth hashes (H(A1), H(A2), and the final response) using ISO-8859-1 character encoding:\n\n```java\n// Line 171 — H(A1)\nString hashA1 = toHexString(digester.digest(a1.getBytes(StandardCharsets.ISO_8859_1)));\n\n// Line 179 — H(A2)\nString hashA2 = toHexString(digester.digest(a2.getBytes(StandardCharsets.ISO_8859_1)));\n\n// Line 196 — Final response hash\nfinal String hashA3 = toHexString(digester.digest(a3.getBytes(StandardCharsets.ISO_8859_1)));\n```\n\nISO-8859-1 (Latin-1) can only encode characters in the range U+0000–U+00FF. Any character outside this range — including all CJK, Cyrillic, Arabic, Greek, Hangul, and emoji characters — is silently replaced with the byte `0x3F` (`?`). `String.getBytes(ISO_8859_1)` in Java performs this replacement without any warning or exception.\n\n### PoC\n```\nPassword: \"我爱Java!密码123★\" (7 non-Latin-1 characters)\n\nUTF-8 encoding:    45 bytes → MD5 H(A1) = 9a4e61484f228633d5d0f95d1bbb0a99\nISO-8859-1:        31 bytes → MD5 H(A1) = d60ddc903d71913bcc3ab4a94f7fc239\nCollision \"??...\": 31 bytes → MD5 H(A1) = d60ddc903d71913bcc3ab4a94f7fc239 ← IDENTICAL\n```\n\nMulti-language confirmation — all four language passwords below produce the same hash:\n\n```\nChinese (密码123)  → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nKorean  (비번123)  → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nCyrillic(аб123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nGreek   (αβ123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nAttacker(??123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560 ← all collide!\n```\n\n### Impact\n**Scenario 1: Authentication Bypass (Collision Attack)**\n\nIf a service using Jetty for Digest authentication has a user with a non-Latin-1 password (e.g., Chinese, Japanese, Russian), an attacker can authenticate as that user using a collision password where all non-Latin-1 characters are replaced with `?`:\n\n- Original password: `我爱Java!密码123★`\n- Collision password: `??Java!??123?`\n- **Both produce identical MD5 hashes under ISO-8859-1** → Authentication succeeds\n\nThis affects any password containing characters \u003e U+00FF, which covers:\n- Chinese (CJK): U+4E00–U+9FFF\n- Japanese (Hiragana/Katakana/Kanji): U+3040–U+30FF, U+4E00+\n- Korean (Hangul): U+AC00–U+D7AF\n- Cyrillic: U+0400–U+04FF (Russian, Ukrainian, Bulgarian, etc.)\n- Arabic: U+0600–U+06FF\n- Greek: U+0370–U+03FF\n- Latin Extended: U+0100–U+024F (accented European characters like ĉ, ğ, ñ when \u003e U+00FF)\n- Emoji / Symbols \u003e U+00FF\n\n**Scenario 2: Denial of Service for Non-Latin-1 Users**\n\nMost modern web applications store password hashes computed using UTF-8. When Jetty's Digest client computes a hash with ISO-8859-1, the bytes differ from what the server stored/expects. This means **any user with non-ASCII (Latin-1+) characters in their password can never successfully authenticate via Digest auth** — even the legitimate user. This is not just a security issue but a functional correctness bug that silently breaks authentication for most non-European-language users.","status":"published","published":"2026-07-22T22:55:18Z","modified":"2026-09-07T08:41:57Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-173","CWE-303"],"updated_at":"2026-11-02T14:41:13.477974Z"}],"nvd":[{"id":"CVE-2026-10050","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.","status":"published","published":"2026-08-04T11:22:43.883Z","modified":"2026-08-08T00:38:56.66Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-173","CWE-303"],"updated_at":"2026-11-02T14:12:34.643497Z"}],"osv":[{"id":"CVE-2026-10050","title":"Digest authentication lossy encoding","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.","status":"published","published":"2026-08-04T11:02:40.503Z","modified":"2026-10-28T02:31:10.487582768Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-173","CWE-303"],"updated_at":"2026-11-02T15:44:53.490346Z"},{"id":"DEBIAN-CVE-2026-10050","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.    This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.    If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.    An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.    Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.","status":"published","published":"2026-08-04T11:22:43.883Z","modified":"2026-11-04T06:00:06.966483514Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-04T06:29:21.687524Z"},{"id":"GHSA-2fvj-hgj9-j2gr","title":"Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution","description":"### Summary\nThe `DigestAuthentication.apply()` method in Jetty's HTTP client uses `getBytes(StandardCharsets.ISO_8859_1)` at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emoji, etc.) with 0x3F (`?`), causing all such characters to produce identical hash contributions. An attacker who knows a victim's username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with `?` characters, since the collision password produces the same MD5-based Digest response hash as the original password.\n\n### Details\n### Root Cause\n\nIn `jetty-core/jetty-client/src/main/java/org/eclipse/jetty/client/DigestAuthentication.java`, the `apply()` method computes the three Digest auth hashes (H(A1), H(A2), and the final response) using ISO-8859-1 character encoding:\n\n```java\n// Line 171 — H(A1)\nString hashA1 = toHexString(digester.digest(a1.getBytes(StandardCharsets.ISO_8859_1)));\n\n// Line 179 — H(A2)\nString hashA2 = toHexString(digester.digest(a2.getBytes(StandardCharsets.ISO_8859_1)));\n\n// Line 196 — Final response hash\nfinal String hashA3 = toHexString(digester.digest(a3.getBytes(StandardCharsets.ISO_8859_1)));\n```\n\nISO-8859-1 (Latin-1) can only encode characters in the range U+0000–U+00FF. Any character outside this range — including all CJK, Cyrillic, Arabic, Greek, Hangul, and emoji characters — is silently replaced with the byte `0x3F` (`?`). `String.getBytes(ISO_8859_1)` in Java performs this replacement without any warning or exception.\n\n### PoC\n```\nPassword: \"我爱Java!密码123★\" (7 non-Latin-1 characters)\n\nUTF-8 encoding:    45 bytes → MD5 H(A1) = 9a4e61484f228633d5d0f95d1bbb0a99\nISO-8859-1:        31 bytes → MD5 H(A1) = d60ddc903d71913bcc3ab4a94f7fc239\nCollision \"??...\": 31 bytes → MD5 H(A1) = d60ddc903d71913bcc3ab4a94f7fc239 ← IDENTICAL\n```\n\nMulti-language confirmation — all four language passwords below produce the same hash:\n\n```\nChinese (密码123)  → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nKorean  (비번123)  → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nCyrillic(аб123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nGreek   (αβ123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560\nAttacker(??123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560 ← all collide!\n```\n\n### Impact\n**Scenario 1: Authentication Bypass (Collision Attack)**\n\nIf a service using Jetty for Digest authentication has a user with a non-Latin-1 password (e.g., Chinese, Japanese, Russian), an attacker can authenticate as that user using a collision password where all non-Latin-1 characters are replaced with `?`:\n\n- Original password: `我爱Java!密码123★`\n- Collision password: `??Java!??123?`\n- **Both produce identical MD5 hashes under ISO-8859-1** → Authentication succeeds\n\nThis affects any password containing characters \u003e U+00FF, which covers:\n- Chinese (CJK): U+4E00–U+9FFF\n- Japanese (Hiragana/Katakana/Kanji): U+3040–U+30FF, U+4E00+\n- Korean (Hangul): U+AC00–U+D7AF\n- Cyrillic: U+0400–U+04FF (Russian, Ukrainian, Bulgarian, etc.)\n- Arabic: U+0600–U+06FF\n- Greek: U+0370–U+03FF\n- Latin Extended: U+0100–U+024F (accented European characters like ĉ, ğ, ñ when \u003e U+00FF)\n- Emoji / Symbols \u003e U+00FF\n\n**Scenario 2: Denial of Service for Non-Latin-1 Users**\n\nMost modern web applications store password hashes computed using UTF-8. When Jetty's Digest client computes a hash with ISO-8859-1, the bytes differ from what the server stored/expects. This means **any user with non-ASCII (Latin-1+) characters in their password can never successfully authenticate via Digest auth** — even the legitimate user. This is not just a security issue but a functional correctness bug that silently breaks authentication for most non-European-language users.","status":"published","published":"2026-07-22T22:55:18Z","modified":"2026-09-10T03:51:10.292148883Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-173","CWE-303"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"UBUNTU-CVE-2026-10050","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.","status":"published","published":"2026-08-04T11:22:00Z","modified":"2026-10-17T12:58:41.095724275Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"CLSA-2026-1787793636","title":"TuxCare security update for org.eclipse.jetty:jetty-security (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-security to address 1 CVE. Fixed in 9.4.63.tuxcare0001.","status":"published","published":"2026-08-27T01:20:36Z","modified":"2026-10-30T19:45:32.290635912Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787864241","title":"TuxCare security update for org.eclipse.jetty:jetty-security (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-security to address 1 CVE. Fixed in 10.0.31.tuxcare0001.","status":"published","published":"2026-08-27T20:57:21Z","modified":"2026-11-02T19:45:59.664918668Z","updated_at":"2026-11-02T20:29:49.757752Z"},{"id":"CLSA-2026-1789159265","title":"TuxCare security update for org.eclipse.jetty:jetty-security (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-security to address 1 CVE. Fixed in 11.0.31.tuxcare0001.","status":"published","published":"2026-09-11T20:41:05Z","modified":"2026-11-02T19:46:13.105038839Z","updated_at":"2026-11-02T20:29:35.589477Z"},{"id":"CLSA-2026-1789219285","title":"TuxCare security update for 123 packages (4 CVEs)","description":"TuxCare rebuilt 123 packages to address 4 CVEs. Fixed in 11.0.32.tuxcare0001.","status":"published","published":"2026-09-12T13:21:25Z","modified":"2026-10-15T09:47:43.90803982Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1793132217","title":"TuxCare security update for 9 packages (5 CVEs)","description":"TuxCare rebuilt 9 packages to address 5 CVEs. Fixed in 12.0.22-tuxcare.1.","status":"published","published":"2026-10-27T20:16:57Z","modified":"2026-11-02T19:46:32.652202463Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793136455","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 11.0.26-tuxcare.3.","status":"published","published":"2026-10-27T21:27:35Z","modified":"2026-11-02T19:46:32.38091334Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793144469","title":"TuxCare security update for org.eclipse.jetty:jetty-security (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-security to address 1 CVE. Fixed in 11.0.27.tuxcare0005.","status":"published","published":"2026-10-27T23:41:09Z","modified":"2026-11-02T19:46:32.856979286Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793147482","title":"TuxCare security update for org.eclipse.jetty:jetty-security (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-security to address 1 CVE. Fixed in 11.0.28.tuxcare0005.","status":"published","published":"2026-10-28T00:31:22Z","modified":"2026-11-02T19:46:32.647606954Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793150376","title":"TuxCare security update for org.eclipse.jetty:jetty-security (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-security to address 1 CVE. Fixed in 11.0.29.tuxcare0004.","status":"published","published":"2026-10-28T01:19:36Z","modified":"2026-11-02T19:46:32.854956186Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1794165486","title":"TuxCare security update for org.eclipse.jetty:jetty-security (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-security to address 1 CVE. Fixed in 11.0.19-tuxcare.5.","status":"published","published":"2026-11-08T20:18:06Z","modified":"2026-11-09T01:45:05.252305257Z","updated_at":"2026-11-09T02:15:19.582074Z"},{"id":"CLSA-2026-1794247837","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 11.0.18-tuxcare.2.","status":"published","published":"2026-11-09T19:10:38Z","modified":"2026-11-10T01:15:02.469925972Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"openSUSE-SU-2026:11505-1","title":"jetty-annotations-9.4.58-5.1 on GA media","description":"These are all security issues fixed in the jetty-annotations-9.4.58-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-13T00:00:00Z","modified":"2026-08-14T10:30:29.825575472Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-10050","title":"CVE-2026-10050 in org.eclipse.jetty:jetty-security - Patched by Root","description":"Root has patched CVE-2026-10050 in the org.eclipse.jetty:jetty-security package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-11-03T08:19:22Z","modified":"2026-11-03T09:15:06.068266202Z","updated_at":"2026-11-03T09:26:33.868904Z"},{"id":"SUSE-SU-2026:3631-1","title":"Security update for jetty-minimal","description":"This update for jetty-minimal fixes the following issues:\n\n- CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution (bsc#1272393).\n","status":"published","published":"2026-08-17T16:52:53Z","modified":"2026-08-18T09:30:04.687146956Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}