CVE-2026-1002 Eclipse Vert.x Web static handler file access denial
Attackers can deny access to static files in Eclipse Vert.x Web by crafting specific URIs that exploit improper URI normalization in the static handler cache.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1002?
CVE-2026-1002 is a medium-severity denial of service vulnerability in Eclipse Vert.x, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.
The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895
Steps to reproduce Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html
Mitgation Disabling Static Handler cache fixes the issue.
StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
Weakness: CWE-444
Which versions are affected by CVE-2026-1002?
4 open source packages ship an affected version, including io.vertx:vertx-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.vertx:vertx-core Maven | All versions | 4.5.24 |
io.vertx:vertx-core Maven | All versions | 4.5.24 |
io.vertx:vertx-core Maven | From 5.0.0.CR1 | 5.0.7 |
io.vertx:vertx-core Maven | From 5.0.0.CR1 | 5.0.7 |
Products include Eclipse Vert.x-Web.
How do I fix CVE-2026-1002?
Upgrade io.vertx:vertx-core to a fixed version for your release line: 4.5.24 or 5.0.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-1002 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-1002 exists.
Other vulnerabilities in Eclipse Vert.x
Sources
Also known as CLEANSTART-2026-EK29154, CLEANSTART-2026-HZ12823, CLEANSTART-2026-ZX15129, ECHO-381d-f8c0-9386, GHSA-cphf-4846-3xx9, MINI-2738-6745-57jq and 18 more.