Read the docs
TI-2026-00756 Aliases CVE-2026-1002GHSA-cphf-4846-3xx9

Eclipse Vert.x Web static handler file access denial

Priority HIGH 70CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 13 fixed, 10 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 Steps to reproduce Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html Mitgation Disabling Static Handler cache fixes the issue. StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial io.vertx:vertx-core (Maven): 4.5.24, 5.0.7Red Hat: 13 advisoriesRed Hat: 13 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse Vert.xEclipse Vert.x4.0.0 – 4.5.23; 5.0.0 – 5.0.6—No fix listedCNA
—io.vertx:vertx-core (Maven)before 4.5.244.5.24Patch availableGHSA-cphf-4846-3xx9
—io.vertx:vertx-core (Maven)5.0.0.CR1 to before 5.0.75.0.7Patch availableGHSA-cphf-4846-3xx9
  • Eclipse Vert.x VendorEclipse Vert.x Affected 4.0.0 – 4.5.23; 5.0.0 – 5.0.6 Fixed in — No fix listed CNA
  • io.vertx:vertx-core (Maven) Vendor— Affected before 4.5.24 Fixed in 4.5.24 Patch available GHSA-cphf-4846-3xx9
  • io.vertx:vertx-core (Maven) Vendor— Affected 5.0.0.CR1 to before 5.0.7 Fixed in 5.0.7 Patch available GHSA-cphf-4846-3xx9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:vert.x-web:*:*:*:*:*:*:*:*4.0.0 – 4.5.23; 5.0.0 – 5.0.6VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:vert.x-web:*:*:*:*:*:*:*:* Versions 4.0.0 – 4.5.23; 5.0.0 – 5.0.6 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-cphf-4846-3xx9 io.vertx:vertx-core (Maven) Fixed in 4.5.24 Advisory →
  • Fix · GHSA-cphf-4846-3xx9 io.vertx:vertx-core (Maven) Fixed in 5.0.7 Advisory →

Red Hat 13 advisories

  • RHSA-2026:34608 Released 2026-07-02 · Red Hat rating Important
    Streams for Apache Kafka 2.9.4 release and security update
    • Streams for Apache Kafka 2.9.4
  • RHSA-2026:33371 Released 2026-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.18 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-services-3.4.10-4.SP2_redhat_00004.1.el7eap +7
  • RHSA-2026:25089 Released 2026-06-10 · Red Hat rating Important
    HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO HawtIO 4.4.0
Show 10 more Red Hat advisories
  • RHSA-2026:17789 Released 2026-05-26 · Red Hat rating Important
    Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:13571 Released 2026-05-04 · Red Hat rating Critical
    Streams for Apache Kafka 3.2.0 release and security update
    • Streams for Apache Kafka 3.2.0
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:8159 Released 2026-04-14 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.3.GA)
    • Red Hat Build of Apache Camel 3.27.1.SP1 io.netty.netty-codec-http-4.1.128.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.128.Final-redhat-00001.jar, io.vertx.vertx-core-4.5.22.redhat-00001.jar
  • RHSA-2026:7109 Released 2026-04-14 · Red Hat rating Important
    Red Hat build of Quarkus 3.20.6 release and security update
    • Red Hat build of Quarkus 3.20.6.redhat io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.132.Final-redhat-00001.jar, io.vertx.vertx-core-4.5.26.redhat-00001.jar +2
  • RHSA-2026:7380 Released 2026-04-14 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.3 release and security update
    • Red Hat build of Quarkus 3.27.3.redhat io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.132.Final-redhat-00001.jar, io.vertx.vertx-core-4.5.26.redhat-00001.jar +2
  • RHSA-2026:6192 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.27.0 Release.
    • Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:5482 Released 2026-03-23 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.1.5 XP 6.0.3.GA release
    • Red Hat JBoss Enterprise Application Platform 6.0.3 io.vertx.vertx-core-4.5.24.redhat-00001.jar
  • RHSA-2026:3951 Released 2026-03-05 · Red Hat rating Important
    JBoss EAP XP 5.0 Update 4.0 release. See references for release notes.
    • Red Hat JBoss EAP XP 5.0 Update 4.0
  • RHSA-2026:3890 Released 2026-03-05 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.14.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Will not fix
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
Cryostat 4 on RHEL 9Fixed RHSA-2026:17789
HawtIO HawtIO 4.4.0Fixed RHSA-2026:25089
Red Hat Build of Apache Camel 3.27.1.SP1Fixed RHSA-2026:8159
Red Hat JBoss EAP XP 5.0 Update 4.0Fixed RHSA-2026:3951
Red Hat JBoss Enterprise Application Platform 6.0.3Fixed RHSA-2026:5482
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2026:33371
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184
Red Hat OpenShift Dev Spaces 3.27Fixed RHSA-2026:6192
Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11Fixed RHSA-2026:3890
Red Hat build of Quarkus 3.20.6.redhatFixed RHSA-2026:7109
Red Hat build of Quarkus 3.27.3.redhatFixed RHSA-2026:7380
Streams for Apache Kafka 2.9.4Fixed RHSA-2026:34608
Streams for Apache Kafka 3.2.0Fixed RHSA-2026:13571
Not affected: 15 products
  • Cryostat 4 on RHEL 9
  • Red Hat Build of Apache Camel 3.27.1.SP1
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 6.0.3
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift Dev Spaces 3.27
  • Red Hat build of Quarkus 3.20.6.redhat
  • Red Hat build of Quarkus 3.27.3.redhat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1002
  2. 2026-10-03 Alias added: GHSA-cphf-4846-3xx9
  3. 2026-10-09 Fix available: RHSA-2026:8159 · Red Hat
  4. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.27.1.SP1 · Red Hat
  5. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 6.0.3 · Red Hat
  6. 2026-10-20 Fix available: Red Hat build of Quarkus 3.20.6.redhat, Red Hat build of Quarkus 3.27.3.redhat · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 4

  • TI-2023-10315 Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web CVSS 3.1MEDIUM 5.3
  • TI-2020-17897 Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences