CVE-2026-1002
mediumpriority · track · 21EPSS 0.004 · 31 %ileDEEUUSEPSS · scored 2026-10-23
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 Steps to reproduce Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html Mitgation Disabling Static Handler cache fixes the issue. StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–6.9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (10)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0761Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-03-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2026-0965IBM Maximo Asset Management: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-04-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Maximo Asset Management ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2026-0977Keycloak: Mehrere SchwachstellenDeutsch2026-04-06csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.
- GHSA-cphf-4846-3xx9Vert.x Web static handler component cache can be manipulated to deny the access to static files2026-01-15ghsa · osvUS
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 Steps to reproduce Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html Mitgation Disabling Static Handler cache fixes the issue. StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://github.com/eclipse-vertx/vert.x/pull/5895cnnvd
- https://github.com/eclipse-vertx/vert.x/tagsPatchcnnvd
- https://github.com/vert-x3/vertx-web/issues/2836cnnvd
- https://vigilance.fr/vulnerability/Vert-x-denial-of-service-via-Web-Static-Handler-Component-Cache-49657cnnvd
- https://github.com/eclipse-vertx/vert.x/pull/5895enisa_euvd
- https://github.com/eclipse-vertx/vert.x/pull/5895Issue TrackingPatchnvd
- https://github.com/vert-x3/vertx-web/issues/2836Exploitnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan