{"action":"Upgrade io.vertx:vertx-core to 4.5.24 (4.x) or 5.0.7 (5.x) or later.","affected":[{"fixed":"4.5.24","introduced":"0"},{"fixed":"5.0.7","introduced":"5.0.0.CR1"}],"component":"io.vertx:vertx-core","cve_ids":["CVE-2026-1002"],"ecosystem":"Maven","epss":0.00384,"exploited":false,"fixed_versions":["4.5.24","5.0.7"],"ghsa_id":"GHSA-cphf-4846-3xx9","id":"tcs_01M5N8SXNJZTM3M26823NTE5GS","modified_at":"2026-09-10T03:50:59.087819170Z","published_at":"2026-01-15T21:31:48Z","references":["https://osv.dev/vulnerability/GHSA-cphf-4846-3xx9","https://nvd.nist.gov/vuln/detail/CVE-2026-1002","https://github.com/vert-x3/vertx-web/issues/2836","https://github.com/eclipse-vertx/vert.x/pull/5894","https://github.com/eclipse-vertx/vert.x/pull/5895","https://github.com/eclipse-vertx/vert.x/commit/5b67f5d17788b2483d277c760f3f8154f9b2fed0","https://github.com/eclipse-vertx/vert.x/commit/d007e7b418543eb1567fe95cf20f5450a5c2d047","https://github.com/eclipse-vertx/vert.x"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-cphf-4846-3xx9","url":"https://osv.dev/vulnerability/GHSA-cphf-4846-3xx9"},{"source":"nvd","source_id":"CVE-2026-1002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1002"}],"summary":"Vert.x Web static handler component cache can be manipulated to deny the access to static files"}