CVE-2026-1002

MEDIUM EPSS 26.2%
Published Jan 15, 20265mo ago · Modified Jun 17, 20261w ago
6.9 CVSS 4.0
Medium
Find Similar
Published Jan 15, 2026 5mo ago
Last Modified Jun 17, 2026 1w ago

Description

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 Steps to reproduce Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html Mitgation Disabling Static Handler cache fixes the issue. StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
26.2% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-444

Affected Products 2

VendorProductVersionRange
eclipsevert.x-web*≥4.0.0  –  ≤4.5.23
eclipsevert.x-web*≥5.0.0  –  ≤5.0.6

References 2

  • github.com https://github.com/eclipse-vertx/vert.x/pull/5895
    Issue TrackingPatch
  • github.com https://github.com/vert-x3/vertx-web/issues/2836
    Exploit

Remediation

  • github.com https://github.com/eclipse-vertx/vert.x/pull/5895
    Issue TrackingPatch