CVE-2026-1002

What it is

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 Steps to reproduce Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html Mitgation Disabling Static Handler cache fixes the issue. StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-01-15 21:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 10:14 UTC Last updatedMost recent change to the record

Details

Published

2026-01-15 21:16 UTC

Last modified

2026-06-17 10:14 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-444

Record status

Analyzed

Affected

• Eclipse vert.x-web ≤ 4.5.23
• Eclipse vert.x-web ≤ 5.0.6

Attack profile CVSS 4.0 · 6.9

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

Low