CVE-2026-1002: Eclipse Vert.x Web static handler file access denial
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.
The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web):
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.vertx:vertx-coreto a version that resolves this vulnerability.Fixed in 5.0.7 - Upgrade
Upgrade
maven/io.vertx:vertx-coreto a version that resolves this vulnerability.Fixed in 4.5.24 - Configuration
Disable StaticHandler caching by configuring StaticHandler.create().setCachingEnabled(false).
Eclipse Vert.x Web StaticHandler cachingEnabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1002?
CVE-2026-1002 is classified as a medium severity vulnerability due to its potential to deny access to static files.
How do I fix CVE-2026-1002?
To fix CVE-2026-1002, upgrade to Vert.x Web version 5.0.7 or version 4.5.24.
What type of application is affected by CVE-2026-1002?
CVE-2026-1002 affects applications utilizing the Eclipse Vert.x Web static handler component.
Can CVE-2026-1002 allow attackers to manipulate requests?
Yes, CVE-2026-1002 allows attackers to manipulate request URIs to deny access to static files.
Who is responsible for patching CVE-2026-1002?
Developers using affected versions of Eclipse Vert.x must apply patches or upgrades to address CVE-2026-1002.