CLEANSTART-2026-FM38692: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes
Published Nov 13, 2026
·Updated
Security vulnerability affects the solr package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.
Affected Software
1 affected componentFixes available
cleanstart/solr<9.11.0-r2
9.11.0-r2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/solrto a version that resolves this vulnerability.Fixed in 9.11.0-r2
Event History
Nov 13, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Can this be exploited remotely without an account or user interaction?
The supplied vector indicates network-reachable exploitation with low attack complexity. It requires no privileges and no user interaction.
2
What is the expected security impact if exploited?
The vector rates confidentiality and availability impact as high. It indicates no integrity impact.