fix(deps): update dependency org.eclipse.jetty:jetty-security to v10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.eclipse.jetty:jetty-security (source)	9.4.57.v20241219 → 10.0.0

---

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

CVE-2026-10050 / GHSA-2fvj-hgj9-j2gr

More information

Details

Summary

The DigestAuthentication.apply() method in Jetty's HTTP client uses getBytes(StandardCharsets.ISO_8859_1) at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emoji, etc.) with 0x3F (?), causing all such characters to produce identical hash contributions. An attacker who knows a victim's username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with ? characters, since the collision password produces the same MD5-based Digest response hash as the original password.

Details

Root Cause

In jetty-core/jetty-client/src/main/java/org/eclipse/jetty/client/DigestAuthentication.java, the apply() method computes the three Digest auth hashes (H(A1), H(A2), and the final response) using ISO-8859-1 character encoding:

// Line 171 — H(A1)
String hashA1 = toHexString(digester.digest(a1.getBytes(StandardCharsets.ISO_8859_1)));

// Line 179 — H(A2)
String hashA2 = toHexString(digester.digest(a2.getBytes(StandardCharsets.ISO_8859_1)));

// Line 196 — Final response hash
final String hashA3 = toHexString(digester.digest(a3.getBytes(StandardCharsets.ISO_8859_1)));

ISO-8859-1 (Latin-1) can only encode characters in the range U+0000–U+00FF. Any character outside this range — including all CJK, Cyrillic, Arabic, Greek, Hangul, and emoji characters — is silently replaced with the byte 0x3F (?). String.getBytes(ISO_8859_1) in Java performs this replacement without any warning or exception.

PoC

Password: "我爱Java!密码123★" (7 non-Latin-1 characters)

UTF-8 encoding:    45 bytes → MD5 H(A1) = 9a4e61484f228633d5d0f95d1bbb0a99
ISO-8859-1:        31 bytes → MD5 H(A1) = d60ddc903d71913bcc3ab4a94f7fc239
Collision "??...": 31 bytes → MD5 H(A1) = d60ddc903d71913bcc3ab4a94f7fc239 ← IDENTICAL

Multi-language confirmation — all four language passwords below produce the same hash:

Chinese (密码123)  → H(A1) = db87f31e8d96cd15f9acec7eabdc4560
Korean  (비번123)  → H(A1) = db87f31e8d96cd15f9acec7eabdc4560
Cyrillic(аб123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560
Greek   (αβ123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560
Attacker(??123)    → H(A1) = db87f31e8d96cd15f9acec7eabdc4560 ← all collide!

Impact

Scenario 1: Authentication Bypass (Collision Attack)

If a service using Jetty for Digest authentication has a user with a non-Latin-1 password (e.g., Chinese, Japanese, Russian), an attacker can authenticate as that user using a collision password where all non-Latin-1 characters are replaced with ?:

• Original password: 我爱Java!密码123★
• Collision password: ??Java!??123?
• Both produce identical MD5 hashes under ISO-8859-1 → Authentication succeeds

This affects any password containing characters > U+00FF, which covers:

• Chinese (CJK): U+4E00–U+9FFF
• Japanese (Hiragana/Katakana/Kanji): U+3040–U+30FF, U+4E00+
• Korean (Hangul): U+AC00–U+D7AF
• Cyrillic: U+0400–U+04FF (Russian, Ukrainian, Bulgarian, etc.)
• Arabic: U+0600–U+06FF
• Greek: U+0370–U+03FF
• Latin Extended: U+0100–U+024F (accented European characters like ĉ, ğ, ñ when > U+00FF)
• Emoji / Symbols > U+00FF

Scenario 2: Denial of Service for Non-Latin-1 Users

Most modern web applications store password hashes computed using UTF-8. When Jetty's Digest client computes a hash with ISO-8859-1, the bytes differ from what the server stored/expects. This means any user with non-ASCII (Latin-1+) characters in their password can never successfully authenticate via Digest auth — even the legitimate user. This is not just a security issue but a functional correctness bug that silently breaks authentication for most non-European-language users.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr
• https://github.com/jetty/jetty.project/issues/15136
• https://github.com/jetty/jetty.project/pull/15160
• https://github.com/jetty/jetty.project/pull/15183
• https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d
• https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d
• https://github.com/jetty/jetty.project
• https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36
• https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Test Results

18 tests   - 636   18 ✅  - 636   4s ⏱️ - 2m 38s
 3 suites  - 105    0 💤 ±  0 
 3 files    - 105    0 ❌ ±  0 

Results for commit 8a03885. ± Comparison against base commit ac47cc8.

This pull request removes 636 tests.

com.mirth.commons.encryption.test.DigesterTest ‑ testArgon2d
com.mirth.commons.encryption.test.DigesterTest ‑ testArgon2i
com.mirth.commons.encryption.test.DigesterTest ‑ testArgon2id
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback1
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback2
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback3
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback4
com.mirth.commons.encryption.test.DigesterTest ‑ testPBKDF2
com.mirth.commons.encryption.test.DigesterTest ‑ testSHA256
com.mirth.commons.encryption.test.EncryptionTest ‑ testDigest
…

♻️ This comment has been updated with latest results.

[jonbartels]

build failure