In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password
    as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset,
    and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that
    cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that
    contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can
    send a request with a digest `Authorization` header crafted with a password made of only `?` characters;
    the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent
    HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that
    defaults to UTF-8 that allows for correct encoding/decoding of passwords. (CVE-2026-10050)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3631-1 advisory.

    - CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution     (bsc#1272393).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password     as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset,     and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that     cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that     contain Chinese, Cyrillic or Greek characters, for example: `123` converts to `??123`. An attacker can     send a request with a digest `Authorization` header crafted with a password made of only `?` characters;
    the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent     HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that     defaults to UTF-8 that allows for correct encoding/decoding of passwords. (CVE-2026-10050)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
460435	Echo: jetty-ee8-security, org.eclipse.jetty.ee8:jetty-ee8-security: security update to 9.4.63org.eclipse.jetty:jetty-security: security update to 10.0.26+echo.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
460435	Echo: jetty-ee8-security, org.eclipse.jetty.ee8:jetty-ee8-security: security update to 9.4.63org.eclipse.jetty:jetty-security: security update to 10.0.26+echo.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
337979	SUSE SLED15: jetty-continuation / jetty-http / jetty-io / jetty-security / etc (SUSE-SU-2026:3631-1)	Nessus	SuSE Local Security Checks	Local	high
332072	Linux Distros Unpatched Vulnerability : CVE-2026-10050	Nessus	Misc.	Local	high
445141	SCA: security update for org.eclipse.jetty.ee8:jetty-ee8-security, org.eclipse.jetty.ee9:jetty-ee9-security, org.eclipse.jetty:jetty-security (GHSA-2fvj-hgj9-j2gr)	Tenable Cloud Security	SCA Checks	Local	high
445141	SCA: security update for org.eclipse.jetty.ee8:jetty-ee8-security, org.eclipse.jetty.ee9:jetty-ee9-security, org.eclipse.jetty:jetty-security (GHSA-2fvj-hgj9-j2gr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-10050

high

Tenable Plugins

high

high

high

high

high

high