CVE-2026-1002: io.vertx:vertx-core Static Handler Cache Manipulation Vulnerability
Summary
CVE-2026-1002: Vert.x Web static handler component cache can be manipulated to deny the access to static files. Affects io.vertx:vertx-core across 2 version ranges.
< 4.5.24
>= 5.0.0.CR1, < 5.0.7
Fixed in 4.5.24 or 5.0.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vert.x is a toolkit for building reactive applications on the JVM. It provides a set of components for building web applications, including a static handler that serves static files. The static handler is designed to efficiently serve files while caching them for performance. However, it has a vulnerability that allows attackers to manipulate the cache, potentially leading to unauthorized access denial of static files.
Vulnerability Detail
The vulnerability arises from an improper implementation of the C. rule of section 5.2.4 of RFC3986 within the Vert.x Web static handler component. This flaw allows an attacker to craft a specific request URI that can manipulate the cache, resulting in an HTTP 404 response for legitimate requests. This can lead to denial of access to static files, affecting the availability of resources served by the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.5.244.5.24 -
>= 5.0.0.CR1, < 5.0.75.0.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can disable the caching feature of the static handler to mitigate the issue. This can be done by configuring the static handler as follows:
StaticHandler staticHandler =
StaticHandler.create().setCachingEnabled(false);
Conclusion
The CVE-2026-1002 vulnerability in the io.vertx:vertx-core package poses a risk of denial of access to static files due to cache manipulation. It is crucial to update to the patched versions or implement the provided workaround to ensure the security and availability of your application.
See every vulnerability recorded for io.vertx:vertx-core →
FAQ
CVE-2026-1002 is a vulnerability in the io.vertx:vertx-core package that allows attackers to manipulate the static handler cache, leading to denial of access to static files.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application's pom.xml with Vulert's playground at Vulert Scanner.
The vulnerability can lead to unauthorized denial of access to static files, potentially disrupting the availability of web resources.
Yes, the vulnerability has been patched in versions 4.5.24 and 5.0.7 of the io.vertx:vertx-core package.
As a workaround, you can disable the caching feature of the static handler to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.vertx:vertx-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
