CVE-2026-1002
1 advisory.
Maven/io.vertx:vertx-core CVE-2026-1002: medium, EPSS 0.38%
Vert.x Web static handler component cache can be manipulated to deny the access to static files
Action: Upgrade io.vertx:vertx-core to 4.5.24 (4.x) or 5.0.7 (5.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.5.24 | - |
| 5.0.0.CR1 | 5.0.7 | - |
Fixed versions
| 4.5.24 | 5.0.7 |
Sources
- osv: GHSA-cphf-4846-3xx9
- https://nvd.nist.gov/vuln/detail/CVE-2026-1002
- https://github.com/vert-x3/vertx-web/issues/2836
- https://github.com/eclipse-vertx/vert.x/pull/5894
- https://github.com/eclipse-vertx/vert.x/pull/5895
- https://github.com/eclipse-vertx/vert.x/commit/5b67f5d17788b2483d277c760f3f8154f9b2fed0
- https://github.com/eclipse-vertx/vert.x/commit/d007e7b418543eb1567fe95cf20f5450a5c2d047
- https://github.com/eclipse-vertx/vert.x
CVE-2026-1002 · published · modified · JSON