Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-10050

Fixed in a distro release EPSS <1%CVSS 8.7

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Published 2026-08-04 · CVE record · OSV

Products: Eclipse Foundation Eclipse Jetty - EE8, Eclipse Foundation Eclipse Jetty - EE9, Eclipse Foundation Eclipse Jetty

Fixed upstream

EcosystemPackageFixed in
Mavenorg.eclipse.jetty.ee8:jetty-ee8-security12.0.36
Mavenorg.eclipse.jetty.ee8:jetty-ee8-security12.1.10
Mavenorg.eclipse.jetty.ee9:jetty-ee9-security12.0.36
Mavenorg.eclipse.jetty.ee9:jetty-ee9-security12.1.10
Mavenorg.eclipse.jetty:jetty-security9.4.63
Mavenorg.eclipse.jetty:jetty-security10.0.31
Mavenorg.eclipse.jetty:jetty-security11.0.31
Mavenorg.eclipse.jetty:jetty-security12.0.36
Mavenorg.eclipse.jetty:jetty-security12.1.10

Distro releases

ReleasePackageFixed in
Chainguardakhq0.27.1-r10
Chainguardapache-activemq-5.19no fix
Chainguardapache-activemq-6.1no fix
Chainguardapache-activemq-6.2no fix
Chainguardapache-activemq-fips-5.19no fix
Chainguardapache-activemq-fips-6.1no fix
Chainguardapache-activemq-fips-6.2no fix
Chainguardapache-hop2.18.1-r16
Chainguardapache-hop-fips2.18.1-r8
Chainguardapache-jena-fuseki6.1.0-r4
Chainguardapache-pulsar-4.1no fix
Chainguardapache-pulsar-fips-4.1no fix
Chainguardapache-tika-2.9no fix
Chainguardapache-tika-3.03.0.0-r31
Chainguardapache-tika-3.13.1.0-r38
Chainguardapache-tika-3.23.2.3-r14
Chainguardapache-tika-3.23.2.3-r18
Chainguardapache-tika-3.2-compat3.2.3-r18
Chainguardapache-tika-3.33.3.2-r2
Chainguardapache-tika-fips-2.9no fix
Chainguardapache-tika-fips-3.03.0.0-r13
Chainguardapache-tika-fips-3.13.1.0-r15
Chainguardapache-tika-fips-3.23.2.3-r13
Chainguardapache-tika-fips-3.33.3.2-r4
Chainguardautomq1.7.4-r1
Chainguardautomqno fix
Chainguardautomq-fipsno fix
Chainguardautomq-fips1.7.4-r1
Chainguardceleborn-0.5no fix
Chainguardceleborn-0.6no fix
Chainguardceleborn-0.7no fix
Chainguardcloudwatch-exporter0.18.0-r5
Chainguardconfluent-kafka8.4.0.397-r0
Chainguardconfluent-kafka-jre-bcfips8.4.0.382-r0
Chainguardcruise-control2.5.146-r1
Chainguardcruise-control-fips2.5.146-r2
Chainguardcruise-control-fips-jars0
Chainguardcruise-control-jars0
Chainguarddata-prepperno fix
Chainguarddependency-track4.14.3-r0
Chainguarddependency-track-bundled4.14.3-r0
Chainguarddruid37.0.0-r47
Chainguarddruid37.0.0-r56
Chainguardhadoop-3.5no fix
Chainguardhadoop-fips-3.3.6no fix
Chainguardhadoop-fips-3.4.2no fix
Chainguardhadoop-fips-3.5no fix
Chainguardjenkins-2.541no fix
Chainguardjenkins-2.541-openjdk-17no fix
Chainguardjenkins-2.541-openjdk-21no fix
Chainguardjenkins-2.541-openjdk-25no fix
Chainguardjenkins-2.555no fix
Chainguardjenkins-2.555-openjdk-21no fix
Chainguardjenkins-2.555-openjdk-25no fix
Chainguardjenkins-2.5682.568.1-r1
Chainguardjenkins-2.568-openjdk-212.568.1-r1
Chainguardjenkins-2.568-openjdk-252.568.1-r1
Chainguardkafka-3.7no fix
Chainguardkafka-3.8no fix
Chainguardkafka-3.9no fix
Chainguardkafka-4.04.0.2-r7
Chainguardkafka-fips-4.34.3.1-r3
Chainguardneo4j-2025.12no fix
Chainguardneo4j-2026.01no fix
Chainguardneo4j-2026.02no fix
Chainguardneo4j-2026.032026.03.1-r1
Chainguardneo4j-2026.04no fix
Chainguardneo4j-2026.05no fix
Chainguardneo4j-2026.062026.06.0-r3
Chainguardneo4j-5.265.26.28-r5
Chainguardreposilite3.6.2-r2
Chainguardsolr-1010.0.0-r8
Chainguardsolr-10-iamguarded-compat10.0.0-r8
Chainguardsolr-9no fix
Chainguardsolr-9-iamguarded-compatno fix
Chainguardsolr-fips-1010.0.0-r2
Chainguardsolr-fips-10-iamguarded-compat10.0.0-r2
Chainguardsolr-fips-9no fix
Chainguardsolr-fips-9-iamguarded-compatno fix
Chainguardspark-3.5-scala-2.12no fix
Chainguardspark-3.5-scala-2.13no fix
Chainguardspark-4.0-scala-2.13no fix
Chainguardspark-4.1-scala-2.13no fix
Chainguardspark-4.2-scala-2.134.2.0-r1
Chainguardspark-fips-3.5-scala-2.12no fix
Chainguardspark-fips-3.5-scala-2.13no fix
Chainguardspark-fips-4.1-scala-2.13no fix
Chainguardspark-fips-4.2-scala-2.134.2.0-r1
Chainguardspark-kubernetes-operator1.0.0-r0
Chainguardspark-kubernetes-operator-fips1.0.0-r0
Chainguardstrimzi-kafka-operator-fips-kafka-thirdparty-libs-cc1.1.0-r5
Chainguardstrimzi-kafka-operator-kafka-thirdparty-libs-cc0
Chainguardtez0.10.5-r22
Chainguardtraccar6.14.5-r1
Chainguardtraccar-fips6.14.5-r3
Chainguardtrinono fix
Chainguardzookeeper-3.8no fix
Chainguardzookeeper-3.9no fix
Chainguardzookeeper-fips-3.8no fix
Chainguardzookeeper-fips-3.9no fix
Debian 12jetty9no fix
Debian 13jetty12no fix
Debian 13jetty9no fix
Debian 14jetty12no fix
Debian 14jetty9no fix
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSjetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSjetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSjetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSjetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise Module for Development Tools 15 SP7jetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise Module for Package Hub 15 SP7jetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise Server 15 SP4-LTSSjetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise Server 15 SP5-LTSSjetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise Server 15 SP6-LTSSjetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4jetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5jetty-minimal9.4.58-150200.3.43.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6jetty-minimal9.4.58-150200.3.43.1
Ubuntu 16.04 LTSjetty9no fix
Ubuntu 18.04 LTSjetty9no fix
Ubuntu 20.04 LTSjetty9no fix
Ubuntu 22.04 LTSjetty9no fix
Ubuntu 24.04 LTSjetty9no fix
Ubuntu 26.04 LTSjetty12no fix
Ubuntu 26.04 LTSjetty9no fix
Ubuntu 26.10jetty12no fix
Ubuntu 26.10jetty9no fix
Wolfiakhq0.27.1-r10
Wolfiapache-pulsar-4.1no fix
Wolfiapache-tika-3.13.1.0-r38
Wolfiapache-tika-3.23.2.3-r14
Wolfiapache-tika-3.23.2.3-r18
Wolfiapache-tika-3.2-compat3.2.3-r18
Wolfiapache-tika-3.33.3.2-r2
Wolficeleborn-0.6no fix
Wolficloudwatch-exporter0.18.0-r5
Wolficonfluent-kafka8.4.0.397-r0
Wolfidependency-track4.14.3-r0
Wolfidependency-track-bundled4.14.3-r0
Wolfidruid37.0.0-r56
Wolfidruid37.0.0-r47
Wolfineo4j-2025.12no fix
Wolfineo4j-2026.01no fix
Wolfineo4j-2026.05no fix
Wolfineo4j-2026.062026.06.0-r3
Wolfisolr-1010.0.0-r8
Wolfisolr-10-iamguarded-compat10.0.0-r8
Wolfispark-4.0-scala-2.13no fix
Wolfispark-4.1-scala-2.13no fix
Wolfistrimzi-kafka-operator-kafka-thirdparty-libs-cc0
Wolfitez0.10.5-r22
Wolfitrinono fix
Wolfizookeeper-3.9no fix
openSUSE Tumbleweedjetty-minimal9.4.58-5.1