CVE-2026-1002
Gravedad CVSS v4.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
15/01/2026
Última modificación:
15/01/2026
Descripción
*** Pendiente de traducción *** The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.<br />
<br />
<br />
The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 <br />
<br />
<br />
<br />
Steps to reproduce<br />
Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html<br />
<br />
Mitgation<br />
Disabling Static Handler cache fixes the issue.<br />
<br />
<br />
<br />
StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
Impacto
Puntuación base 4.0
6.90
Gravedad 4.0
MEDIA