The vulnerability in Eclipse Jetty's Digest authentication arises because the server-side component encodes passwords using ISO-8859-1, per historical HTTP specifications. Password characters outside this charset are silently replaced with '?', causing different passwords with non-ISO-8859-1 characters to be treated equivalently. An attacker can exploit this by sending a crafted Authorization header with a password composed solely of '?' characters, potentially bypassing authentication checks for passwords containing non-ISO-8859-1 characters. The updated HTTP Digest specification (RFC-7616) supports a charset parameter defaulting to UTF-8, which mitigates this issue by properly encoding such characters.

This vulnerability allows an attacker to bypass Digest authentication checks when the legitimate password contains characters outside ISO-8859-1, such as Chinese, Cyrillic, or Greek characters. The attacker can authenticate by sending a digest with a password composed of '?' characters matching the length of the target password, potentially gaining unauthorized access. The CVSS score of 9.1 indicates a high severity with network attack vector, no privileges required, no user interaction, high confidentiality impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Eclipse Jetty vendor advisories for updates implementing support for the charset parameter per RFC-7616 or other fixes. Until a patch is available, consider avoiding passwords with non-ISO-8859-1 characters or disabling Digest authentication if feasible.