Detections
Analytics

SCA: security update for org.eclipse.jetty.ee8:jetty-ee8-security, org.eclipse.jetty.ee9:jetty-ee9-security, org.eclipse.jetty:jetty-security (GHSA-2fvj-hgj9-j2gr)

high Tenable Self-Hosted Container Security Plugin ID 445141

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password
 as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset,
 and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that
 cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that
 contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can
 send a request with a digest `Authorization` header crafted with a password made of only `?` characters;
 the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent
 HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that
 defaults to UTF-8 that allows for correct encoding/decoding of passwords. (CVE-2026-10050)

Solution

Update the org.eclipse.jetty:jetty-security library and its related packages to version 10.0.31 or later.

See Also

https://github.com/advisories/GHSA-2fvj-hgj9-j2gr

Plugin Details

Severity: High

ID: 445141

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 7/23/2026

Updated: 8/10/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.66

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2026-10050

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 7.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/22/2026

Vulnerability Publication Date: 7/22/2026

Reference Information

CVE: CVE-2026-10050