CVE-2026-1002
📋 TL;DR
This vulnerability in Vert.x Web's static handler allows attackers to manipulate the cache to deny access to static files via specially crafted URIs. It affects applications using Vert.x Web's static handler with caching enabled. The issue stems from improper URI normalization implementation.
💻 Affected Systems
- Vert.x Web
- Vert.x Core
📦 What is this software?
Vert.x Web by Eclipse
Vert.x Web by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for all static content served by the application, potentially breaking application functionality that relies on static assets.
Likely Case
Selective denial of access to specific static files, causing partial service disruption for users.
If Mitigated
No impact if caching is disabled or the patch is applied.
🎯 Exploit Status
Exploitation requires only HTTP requests with crafted URIs, no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version containing PR #5895 fix
Vendor Advisory: https://github.com/eclipse-vertx/vert.x/pull/5895
Restart Required: Yes
Instructions:
1. Update Vert.x to version containing PR #5895 fix. 2. Restart application. 3. Verify caching behavior is corrected.
🔧 Temporary Workarounds
Disable Static Handler Cache
allDisables caching in StaticHandler which prevents the vulnerability
StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
🧯 If You Can't Patch
- Implement WAF rules to block URIs containing patterns like '%2F..%2F'
- Use reverse proxy to sanitize and normalize URIs before reaching Vert.x
🔍 How to Verify
Check if Vulnerable:
Test with crafted URI: Access a known static file, then try accessing same file with pattern like '/foo/bar%2F..%2Findex.html'. If second request returns 404, system is vulnerable.Check Version:
Check Vert.x version in application dependencies or runtimeVerify Fix Applied:
Repeat vulnerable test - crafted URI should return the file normally, not 404.📡 Detection & Monitoring
Log Indicators:
- Multiple 404 responses for known static files
- URIs containing '%2F..%2F' patterns in access logs
Network Indicators:
- HTTP requests with encoded slash patterns in URIs
- Unusual 404 response patterns for static content
SIEM Query:
http.uri contains "%2F..%2F" AND http.status_code = 404