Skip to content
Fencer Intel
medium 5.3

CVE-2026-1002 json

Eclipse Vert.x Web static handler file access denial

published 9mo ago modified last mo. also GHSA-cphf-4846-3xx9 , EUVD-2026-2695

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits
0
none known

Summary

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.

The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895

Steps to reproduce Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html

Mitgation Disabling Static Handler cache fixes the issue.

StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);

Patch / fix

  • maven io.vertx:vertx-core 4.5.24, 5.0.7
  • eap7-wildfly jboss enterprise application platform eus 7.3 7.3.18-3.GA_redhat_00001.1.el7eap
  • eap7-undertow jboss enterprise application platform eus 7.3 2.0.41-8.SP9_redhat_00001.1.el7eap
  • eap7-apache-cxf jboss enterprise application platform eus 7.3 3.4.10-4.SP2_redhat_00004.1.el7eap
  • eap7-apache-cxf-rt jboss enterprise application platform eus 7.3 3.4.10-4.SP2_redhat_00004.1.el7eap
  • eap7-wildfly-modules jboss enterprise application platform eus 7.3 7.3.18-3.GA_redhat_00001.1.el7eap
  • eap7-apache-cxf-tools jboss enterprise application platform eus 7.3 3.4.10-4.SP2_redhat_00004.1.el7eap
  • eap7-wildfly-javadocs jboss enterprise application platform eus 7.3 7.3.18-3.GA_redhat_00001.1.el7eap
  • eap7-wildfly-java-jdk8 jboss enterprise application platform eus 7.3 7.3.18-3.GA_redhat_00001.1.el7eap

red hat advisories RHSA-2026:33371

Is CVE-2026-1002 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-1002 updated cvss 5.3

io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files

  • Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, +4 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apache Camel 4 for Quarkus 3 vertx-core
    affected: workaround, no fix available
  • Red Hat build of Apicurio Registry 2 vertx-core
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 3 vertx-core
    affected: workaround, no fix available
  • Red Hat build of Debezium 2 vertx-core Red Hat build of Debezium 3 vertx-core Red Hat build of OptaPlanner 8 vertx-core Red Hat Fuse 7 vertx-core
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack vertx-core
    affected: workaround, no fix available
  • Red Hat Process Automation 7 vertx-core
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-9, cryostat/jfr-datasource-rhel9 4.2.0-9, cryostat/cryostat-reports-rhel9 4.2.0-9
    fixed: vendor fix RHSA-2026:17789
show 15 more
  • Red Hat HawtIO HawtIO 4.4.0
    fixed: vendor fix RHSA-2026:25089
  • Red Hat Build of Apache Camel 3.27.1.SP1 vertx-core 4.5.22.redhat-00001
    fixed: vendor fix RHSA-2026:8159
  • Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11
    fixed: vendor fix RHSA-2026:3890
  • Red Hat build of Quarkus 3.20.6.redhat vertx-core 4.5.26.redhat-00001
    fixed: vendor fix RHSA-2026:7109
  • Red Hat build of Quarkus 3.27.3.redhat vertx-core 4.5.26.redhat-00001
    fixed: vendor fix RHSA-2026:7380
  • Red Hat JBoss EAP XP 5.0 Update 4.0
    fixed: vendor fix RHSA-2026:3951
  • Red Hat JBoss Enterprise Application Platform 6.0.3 vertx-core 4.5.24.redhat-00001
    fixed: vendor fix RHSA-2026:5482
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-modules 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-javadocs 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk8 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk11 7.3.18-3.GA_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2026:33371
  • Red Hat OpenShift AI 2.25 rhoai 1776748859
    fixed: vendor fix RHSA-2026:10184
  • Red Hat OpenShift Dev Spaces 3.27 devspaces 1774228740
    fixed: vendor fix RHSA-2026:6192
  • Red Hat Streams for Apache Kafka 2.9.4
    fixed: vendor fix RHSA-2026:34608
  • Red Hat Streams for Apache Kafka 3.2.0
    fixed: vendor fix RHSA-2026:13571
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-db-rhel9 4.2.0-13, cryostat/cryostat-storage-rhel9 4.2.0-13, cryostat/cryostat-operator-bundle 4.2.0-7, cryostat/cryostat-rhel9-operator 4.2.0-13, cryostat/cryostat-agent-init-rhel9 0.7.0-7, cryostat/cryostat-grafana-dashboard-rhel9 4.2.0-9, +1 more Red Hat Build of Apache Camel 3.27.1.SP1 jimfs 1.1, jna 5.8.0, s3 2.32.4, bcel 6.7.0, bson 5.5.1, gax 2.57.0, +1536 more Red Hat build of Quarkus 3.20.6.redhat jna 5.8.0, lit 3.2.1, bson 5.3.1, db2 1.20.6, h2 2.3.230, y18n 5.0.8, +1015 more Red Hat build of Quarkus 3.27.3.redhat jna 5.8.0, db2 1.21.4, h2 2.3.230, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1005 more
    not affected: vulnerable code not present
  • Red Hat Data Grid 8 vertx-core
    not affected: component not present
  • Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc Red Hat Enterprise Linux 9 resteasy, pki-resteasy-core, pki-resteasy-client, pki-resteasy-jackson2-provider, pki-resteasy-servlet-initializer Red Hat Enterprise Linux 10 moditect Red Hat JBoss Enterprise Application Platform 6.0.3 pom.xml, liblz4-java.so, libsnappyjava.so, commons-logging 1.2, wc-chatbot-0.1.2.jar, commons-beanutils 1.9.4, +256 more Red Hat JBoss Enterprise Application Platform 7 vertx-core Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-undertow 2.0.41-8.SP9_redhat_00001.1.el7eap, eap7-apache-cxf 3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt 3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-tools 3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-services 3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-jboss-server-migration 1.7.2-23.Final_redhat_00025.1.el7eap, +21 more
    +4 more products
    Red Hat JBoss Enterprise Application Platform 8 vertx-core Red Hat OpenShift AI (RHOAI) rhoai/odh-trustyai-service-rhel8 Red Hat OpenShift AI 2.25 rhoai 1775144403, rhoai 1776243157, rhoai 1776243163, rhoai 1776243192, rhoai 1776243217, rhoai 1776243229, +70 more Red Hat OpenShift Dev Spaces 3.27 devspaces 1773775028, devspaces 1773775064, devspaces 1773775544, devspaces 1774070844, devspaces 1774143680, devspaces 1774155063, +9 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
9mo ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/vert-x3/vertx-web/issues/2836 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
maven io.vertx:vertx-core
<4.5.24
>=5.0.0.CR1, <5.0.7
4.5.24
5.0.7

Affected products

  • Eclipse Vert.x Eclipse Vert.x

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.