Vulnerability · Published Jan 15, 2026 · Assigned by eclipse
CVE-2026-1002Eclipse Vert.x Web static handler file access denial
Medium 6.9
In plain English
A medium-severity security flaw in Eclipse Vert.x from Eclipse Vert.x. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 Steps to reproduce Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html Mitgation Disabling Static Handler cache fixes the issue. StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.vertx:vertx-core | 4.5.24 | GHSA-cphf-4846-3xx9 |
| Maven | io.vertx:vertx-core | 5.0.7 | GHSA-cphf-4846-3xx9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Vert.x | Eclipse Vert.x | 4.0.0 – through 4.5.235.0.0 – through 5.0.6 |
Weakness: CWE-444 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L