Path traversal in Eclipse Vert.x
Priority MEDIUM 46CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.
Why it matters now
EPSS 0.02002 80th percentileScored 2026-11-07
Fix Fixed io.vertx:vertx-web (Maven): 3.9.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Vert.x | 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, 4.0.0.Beta3 | — | No fix listed | CNA |
| — | io.vertx:vertx-web (Maven) | 3.0.0 to before 3.9.4 | 3.9.4 | Patch available | GHSA-vjw7-6gfq-6wf5 |
- Eclipse Vert.x VendorEclipse Foundation Affected 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, 4.0.0.Beta3 Fixed in — No fix listed CNA
- io.vertx:vertx-web (Maven) Vendor— Affected 3.0.0 to before 3.9.4 Fixed in 3.9.4 Patch available GHSA-vjw7-6gfq-6wf5
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* | 3.4.0 – 3.9.4 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:* | 4.0.0 beta1 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:* | 4.0.0 beta2 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:* | 4.0.0 beta3 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:* | 4.0.0 milestone1 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:* | 4.0.0 milestone2 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:* | 4.0.0 milestone3 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:* | 4.0.0 milestone4 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:* | 4.0.0 milestone5 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* Versions 3.4.0 – 3.9.4 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:* Versions 4.0.0 beta1 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:* Versions 4.0.0 beta2 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:* Versions 4.0.0 beta3 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:* Versions 4.0.0 milestone1 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:* Versions 4.0.0 milestone2 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:* Versions 4.0.0 milestone3 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:* Versions 4.0.0 milestone4 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:* Versions 4.0.0 milestone5 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-vjw7-6gfq-6wf5 io.vertx:vertx-web (Maven) Fixed in 3.9.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-17640
- 2026-10-03 Alias added: GHSA-vjw7-6gfq-6wf5
References
Advisory 2
Other 12
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list
- https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941%40%3Ccommits.servicecomb.apache.org%3E
- [pulsar-commits] 20210610 [GitHub] [pulsar] lhotari opened a new pull request #10889: [Security] Upgrade vertx to 3.9.8 to address CVE-2019-17640
- [pulsar-commits] 20210621 [GitHub] [pulsar] lhotari merged pull request #10889: [Security] Upgrade vertx to 3.9.8 to address CVE-2019-17640
- [pulsar-commits] 20210625 [pulsar] 03/13: [Security] Upgrade vertx to 3.9.8 to address CVE-2019-17640 (#10889)
- https://github.com/vert-x3/vertx-web/commit/b12f7c4c6576a8adc3f683b2899de4b0e7d099e4
- https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941@%3Ccommits.servicecomb.apache.org%3E
- https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rfd0ebf8387cfd0b959d1e218797e709793cce51a5ea2f84d0976f47d@%3Ccommits.pulsar.apache.org%3E
- https://mvnrepository.com/artifact/io.vertx/vertx-web
More Eclipse Foundation Vert.x vulnerabilities
- TI-2026-06017 Improper certificate validation in Eclipse Vert.x CVSS 4.0MEDIUM 6.9
- TI-2025-10971 In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler… CVSS 4.0MEDIUM 6.3
- TI-2018-09003 XML external entity injection in Eclipse Vert.x CVSS 3.0CRITICAL 9.8
- TI-2018-09001 Path traversal in Eclipse Vert.x CVSS 3.0CRITICAL 9.8
- TI-2025-10972 Cross-site scripting in Eclipse Foundation Vert.x CVSS 4.0LOW 2.3
- TI-2026-74673 Compression bomb in Eclipse Vert.x gRPC server CVSS 4.0HIGH 8.7
Sources
- CVE-2019-17640 · CVE Program
- CVE-2019-17640 · NVD
- FIRST EPSS
- GHSA-vjw7-6gfq-6wf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences