PT-2026-3133 · Eclipse · Vert.X

Classicvalues + 2 · Published 2026-01-15 · Updated 2026-05-18 · CVE-2026-1002

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vert.x versions (affected versions not specified)

Description The Vert.x Web static handler component cache can be manipulated to deny access to static files served by the handler using specifically crafted request URIs. This is due to an improper implementation of RFC3986 section 5.2.4. An attacker can craft a request URI containing a string like bar%2F..%2F after the last / character to deny access to the URI, resulting in an HTTP 404 response. This can lead to a persistent Denial of Service for legitimate files.

Recommendations Disable the Static Handler cache by setting setCachingEnabled(false) on the StaticHandler instance.

Exploit

Fix

DoS

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CLEANSTART-2026-DC73689

CLEANSTART-2026-GM79879

CLEANSTART-2026-GQ14179

CLEANSTART-2026-IA43044

CLEANSTART-2026-QI14017

CLEANSTART-2026-TZ04509

CLEANSTART-2026-VJ37814

CVE-2026-1002

GHSA-CPHF-4846-3XX9

Affected Products

Vert.X

References · 134

• 🔥 https://github.com/vert-x3/vertx-web/issues/2836 · Exploit
• https://github.com/eclipse-vertx/vert.x/pull/5895 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42577 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-42889 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1002 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-DC73689 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cphf-4846-3xx9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25710 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57699 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47554 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-QI14017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5598 · Security Note