CVE-2026-1002
Severity CVSS v4.0:
MEDIUM
Type:
Unavailable / Other
Publication date:
15/01/2026
Last modified:
05/02/2026
Description
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.<br />
<br />
<br />
The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 <br />
<br />
<br />
<br />
Steps to reproduce<br />
Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html<br />
<br />
Mitgation<br />
Disabling Static Handler cache fixes the issue.<br />
<br />
<br />
<br />
StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
Impact
Base Score 4.0
6.90
Severity 4.0
MEDIUM
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:eclipse:vert.x-web:*:*:*:*:*:*:*:* | 4.0.0 (including) | 4.5.23 (including) |
| cpe:2.3:a:eclipse:vert.x-web:*:*:*:*:*:*:*:* | 5.0.0 (including) | 5.0.6 (including) |
To consult the complete list of CPE names with products and versions, see this page