CVE-2026-1002
Severity CVSS v4.0:
MEDIUM
Type:
Unavailable / Other
Publication date:
15/01/2026
Last modified:
15/01/2026
Description
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.<br />
<br />
<br />
The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 <br />
<br />
<br />
<br />
Steps to reproduce<br />
Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html<br />
<br />
Mitgation<br />
Disabling Static Handler cache fixes the issue.<br />
<br />
<br />
<br />
StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
Impact
Base Score 4.0
6.90
Severity 4.0
MEDIUM