CVE-2026-1002 - Eclipse Vert.x Plugin
CVE-2026-1002
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.
The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895
Steps to reproduce
Given a file served by the static handler, craft an URI that introduces a string like bar.. after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar..index.html
Mitgation
Disabling Static Handler cache fixes the issue.
StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
CVE-2026-1002
MEDIUM
CVSS 6.9
Published 2026-01-15
Updated 2026-02-05
AI Risk Elevated (69/100)
Active Exploit: No strong signal
Published Exploit: Public exploit references found
Priority: P3 Priority
Severity Band
MEDIUM
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected Components
1
Reference Links
2
AI Risk Engine
Elevated (69/100)
Exploitability
Medium
Active Exploitation
No strong signal
Published Exploit Status
Public exploit references found
AI Context
Machine-generated threat intelligence
AI
Updated 16 days ago
AI enriched 16 days ago (2026-04-09 08:08 UTC)
Technical Summary
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 Steps to reproduce Given a file served by the static handler, craft an URI that introduces a string like bar.. after the last / char to…
Potential Impact
Severity is MEDIUM (CVSS 6.9). Depending on deployment context, affected components may be exposed to unauthorized actions or data integrity risk.
Exploitability Assessment
Exploitability is assessed as Medium based on published exploit references.
Primary risk drivers: published exploit references
Mitigation Recommendations
Validate affected product versions, prioritize patching, and monitor references for vendor remediation guidance. If immediate patching is not possible, apply compensating controls and limit exposure of vulnerable surfaces.
Detection & Monitoring
Track authentication anomalies, unexpected file writes, and suspicious plugin API activity around affected components.
Business Impact Lens
Prioritize remediation where affected components process customer data, admin sessions, or Internet-exposed workflows.
