GHSA-2fvj-hgj9-j2gr

Suggest an improvement
Source
https://github.com/advisories/GHSA-2fvj-hgj9-j2gr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-2fvj-hgj9-j2gr
Aliases
Downstream
Published
2026-07-22T22:55:18Z
Modified
2026-07-22T23:25:41Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
Details

Summary

The DigestAuthentication.apply() method in Jetty's HTTP client uses getBytes(StandardCharsets.ISO_8859_1) at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emoji, etc.) with 0x3F (?), causing all such characters to produce identical hash contributions. An attacker who knows a victim's username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with ? characters, since the collision password produces the same MD5-based Digest response hash as the original password.

Details

Root Cause

In jetty-core/jetty-client/src/main/java/org/eclipse/jetty/client/DigestAuthentication.java, the apply() method computes the three Digest auth hashes (H(A1), H(A2), and the final response) using ISO-8859-1 character encoding:

// Line 171 — H(A1)
String hashA1 = toHexString(digester.digest(a1.getBytes(StandardCharsets.ISO_8859_1)));

// Line 179 — H(A2)
String hashA2 = toHexString(digester.digest(a2.getBytes(StandardCharsets.ISO_8859_1)));

// Line 196 — Final response hash
final String hashA3 = toHexString(digester.digest(a3.getBytes(StandardCharsets.ISO_8859_1)));

ISO-8859-1 (Latin-1) can only encode characters in the range U+0000–U+00FF. Any character outside this range — including all CJK, Cyrillic, Arabic, Greek, Hangul, and emoji characters — is silently replaced with the byte 0x3F (?). String.getBytes(ISO_8859_1) in Java performs this replacement without any warning or exception.

PoC

Password: "我爱Java!密码123★" (7 non-Latin-1 characters)

UTF-8 encoding:    45 bytes → MD5 H(A1) = 9a4e61484f228633d5d0f95d1bbb0a99
ISO-8859-1:        31 bytes → MD5 H(A1) = d60ddc903d71913bcc3ab4a94f7fc239
Collision "??...": 31 bytes → MD5 H(A1) = d60ddc903d71913bcc3ab4a94f7fc239 ← IDENTICAL

Multi-language confirmation — all four language passwords below produce the same hash:

Chinese (密码123)  → H(A1) = db87f31e8d96cd15f9acec7eabdc4560
Korean  (비번123)  → H(A1) = db87f31e8d96cd15f9acec7eabdc4560
Cyrillic(аб123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560
Greek   (αβ123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560
Attacker(??123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560 ← all collide!

Impact

Scenario 1: Authentication Bypass (Collision Attack)

If a service using Jetty for Digest authentication has a user with a non-Latin-1 password (e.g., Chinese, Japanese, Russian), an attacker can authenticate as that user using a collision password where all non-Latin-1 characters are replaced with ?:

  • Original password: 我爱Java!密码123★
  • Collision password: ??Java!??123?
  • Both produce identical MD5 hashes under ISO-8859-1 → Authentication succeeds

This affects any password containing characters > U+00FF, which covers:

  • Chinese (CJK): U+4E00–U+9FFF
  • Japanese (Hiragana/Katakana/Kanji): U+3040–U+30FF, U+4E00+
  • Korean (Hangul): U+AC00–U+D7AF
  • Cyrillic: U+0400–U+04FF (Russian, Ukrainian, Bulgarian, etc.)
  • Arabic: U+0600–U+06FF
  • Greek: U+0370–U+03FF
  • Latin Extended: U+0100–U+024F (accented European characters like ĉ, ğ, ñ when > U+00FF)
  • Emoji / Symbols > U+00FF

Scenario 2: Denial of Service for Non-Latin-1 Users

Most modern web applications store password hashes computed using UTF-8. When Jetty's Digest client computes a hash with ISO-8859-1, the bytes differ from what the server stored/expects. This means any user with non-ASCII (Latin-1+) characters in their password can never successfully authenticate via Digest auth — even the legitimate user. This is not just a security issue but a functional correctness bug that silently breaks authentication for most non-European-language users.

Database specific 
{
    "cwe_ids":  [
        "CWE-173",
        "CWE-303"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-22T22:55:18Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Maven
org.eclipse.jetty:jetty-security

Package

Name
org.eclipse.jetty:jetty-security
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-security

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9.4.0.v20161208
Fixed
9.4.63

Affected versions

9.*
9.4.0.v20161208
9.4.0.v20180619
9.4.1.v20170120
9.4.1.v20180619
9.4.2.v20170220
9.4.2.v20180619
9.4.3.v20170317
9.4.3.v20180619
9.4.4.v20170414
9.4.4.v20180619
9.4.5.v20170502
9.4.5.v20180619
9.4.6.v20170531
9.4.6.v20180619
9.4.7.RC0
9.4.7.v20170914
9.4.7.v20180619
9.4.8.v20171121
9.4.8.v20180619
9.4.9.v20180320
9.4.10.RC0
9.4.10.RC1
9.4.10.v20180503
9.4.11.v20180605
9.4.12.RC0
9.4.12.RC1
9.4.12.RC2
9.4.12.v20180830
9.4.13.v20181111
9.4.14.v20181114
9.4.15.v20190215
9.4.16.v20190411
9.4.17.v20190418
9.4.18.v20190429
9.4.19.v20190610
9.4.20.v20190813
9.4.21.v20190926
9.4.22.v20191022
9.4.23.v20191118
9.4.24.v20191120
9.4.25.v20191220
9.4.26.v20200117
9.4.27.v20200227
9.4.28.v20200408
9.4.29.v20200521
9.4.30.v20200611
9.4.31.v20200723
9.4.32.v20200930
9.4.33.v20201020
9.4.34.v20201102
9.4.35.v20201120
9.4.36.v20210114
9.4.37.v20210219
9.4.38.v20210224
9.4.39.v20210325
9.4.40.v20210413
9.4.41.v20210516
9.4.42.v20210604
9.4.43.v20210629
9.4.44.v20210927
9.4.45.v20220203
9.4.46.v20220331
9.4.47.v20220610
9.4.48.v20220622
9.4.49.v20220914
9.4.50.v20221201
9.4.51.v20230217
9.4.52.v20230823
9.4.53.v20231009
9.4.54.v20240208
9.4.55.v20240627
9.4.56.v20240826
9.4.57.v20241219
9.4.58.v20250814

Database specific

last_known_affected_version_range 
"<= 9.4.58.v20250814"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"
org.eclipse.jetty:jetty-security

Package

Name
org.eclipse.jetty:jetty-security
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-security

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.0.0
Fixed
10.0.31

Affected versions

10.*
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.0.6
10.0.7
10.0.8
10.0.9
10.0.10
10.0.11
10.0.12
10.0.13
10.0.14
10.0.15
10.0.16
10.0.17
10.0.18
10.0.19
10.0.20
10.0.21
10.0.22
10.0.23
10.0.24
10.0.25
10.0.26

Database specific

last_known_affected_version_range 
"<= 10.0.26"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"
org.eclipse.jetty:jetty-security

Package

Name
org.eclipse.jetty:jetty-security
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-security

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11.0.0
Fixed
11.0.31

Affected versions

11.*
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.0.10
11.0.11
11.0.12
11.0.13
11.0.14
11.0.15
11.0.16
11.0.17
11.0.18
11.0.19
11.0.20
11.0.21
11.0.22
11.0.23
11.0.24
11.0.25
11.0.26

Database specific

last_known_affected_version_range 
"<= 11.0.26"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"
org.eclipse.jetty:jetty-security

Package

Name
org.eclipse.jetty:jetty-security
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-security

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12.0.0
Fixed
12.0.36

Affected versions

12.*
12.0.0
12.0.1
12.0.2
12.0.3
12.0.4
12.0.5
12.0.6
12.0.7
12.0.8
12.0.9
12.0.10
12.0.11
12.0.12
12.0.13
12.0.14
12.0.15
12.0.16
12.0.17
12.0.18
12.0.19
12.0.20
12.0.21
12.0.22
12.0.23
12.0.24
12.0.25
12.0.26
12.0.27
12.0.28
12.0.29
12.0.30
12.0.31
12.0.32
12.0.33
12.0.34
12.0.35

Database specific

last_known_affected_version_range 
"<= 12.0.35"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"
org.eclipse.jetty.ee8:jetty-ee8-security

Package

Name
org.eclipse.jetty.ee8:jetty-ee8-security
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-security

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12.0.0
Fixed
12.0.36

Affected versions

12.*
12.0.0
12.0.1
12.0.2
12.0.3
12.0.4
12.0.5
12.0.6
12.0.7
12.0.8
12.0.9
12.0.10
12.0.11
12.0.12
12.0.13
12.0.14
12.0.15
12.0.16
12.0.17
12.0.18
12.0.19
12.0.20
12.0.21
12.0.22
12.0.23
12.0.24
12.0.25
12.0.26
12.0.27
12.0.28
12.0.29
12.0.30
12.0.31
12.0.32
12.0.33
12.0.34
12.0.35

Database specific

last_known_affected_version_range 
"<= 12.0.35"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"
org.eclipse.jetty.ee9:jetty-ee9-security

Package

Name
org.eclipse.jetty.ee9:jetty-ee9-security
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12.0.0
Fixed
12.0.36

Affected versions

12.*
12.0.0
12.0.1
12.0.2
12.0.3
12.0.4
12.0.5
12.0.6
12.0.7
12.0.8
12.0.9
12.0.10
12.0.11
12.0.12
12.0.13
12.0.14
12.0.15
12.0.16
12.0.17
12.0.18
12.0.19
12.0.20
12.0.21
12.0.22
12.0.23
12.0.24
12.0.25
12.0.26
12.0.27
12.0.28
12.0.29
12.0.30
12.0.31
12.0.32
12.0.33
12.0.34
12.0.35

Database specific

last_known_affected_version_range 
"<= 12.0.35"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"
org.eclipse.jetty:jetty-security

Package

Name
org.eclipse.jetty:jetty-security
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-security

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12.1.0
Fixed
12.1.10

Affected versions

12.*
12.1.0
12.1.1
12.1.2
12.1.3
12.1.4
12.1.5
12.1.6
12.1.7
12.1.8
12.1.9

Database specific

last_known_affected_version_range 
"<= 12.1.9"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"
org.eclipse.jetty.ee8:jetty-ee8-security

Package

Name
org.eclipse.jetty.ee8:jetty-ee8-security
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-security

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12.1.0
Fixed
12.1.10

Affected versions

12.*
12.1.0
12.1.1
12.1.2
12.1.3
12.1.4
12.1.5
12.1.6
12.1.7
12.1.8
12.1.9

Database specific

last_known_affected_version_range 
"<= 12.1.9"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"
org.eclipse.jetty.ee9:jetty-ee9-security

Package

Name
org.eclipse.jetty.ee9:jetty-ee9-security
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12.1.0
Fixed
12.1.10

Affected versions

12.*
12.1.0
12.1.1
12.1.2
12.1.3
12.1.4
12.1.5
12.1.6
12.1.7
12.1.8
12.1.9

Database specific

last_known_affected_version_range 
"<= 12.1.9"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2fvj-hgj9-j2gr/GHSA-2fvj-hgj9-j2gr.json"