CVE-2026-1002: 
Java vulnerability analysis and mitigation

CVE-2026-1002 is a cache manipulation vulnerability in the Eclipse Vert.x Web static handler component that allows unauthenticated remote attackers to deny access to static files by sending specially crafted request URIs. The flaw was disclosed on January 15, 2026, and affects Eclipse Vert.x-web versions 4.0.0 through 4.5.23 and 5.0.0 through 5.0.6. Downstream products including IBM Event Processing and IBM watsonx Orchestrate are also affected. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Vert.x PR).

The root cause is an improper implementation of rule C in section 5.2.4 of RFC3986 within the HttpUtils#removeDots method (CWE-444 — Inconsistent Interpretation of HTTP Requests). Specifically, when the output buffer does not contain a /, the implementation fails to discard the entire buffer content as required by the RFC, causing percent-encoded path traversal sequences (e.g., bar%2F..%2F) to be resolved incorrectly. An attacker exploits this by sending a crafted URI such as https://example.com/foo/bar%2F..%2Findex.html targeting a file served by the static handler; the malformed path is cached as non-existent, causing all subsequent legitimate requests for that resource to return HTTP 404. No authentication or user interaction is required, and the attack is executable over the network (Github Issue, Vert.x PR).

Successful exploitation causes a persistent denial-of-service condition for static file access: once a crafted request poisons the StaticHandlerImpl cache, all subsequent legitimate requests for the affected resource return HTTP 404 until the cache is cleared or the service is restarted. This can block access to critical web assets such as stylesheets, JavaScript files, images, and other static resources hosted via Vert.x Web. There is no confidentiality or integrity impact — the vulnerability is limited to availability of static content served through the affected handler (Github Advisory, Github Issue).

1. Reconnaissance: Identify web applications using Eclipse Vert.x Web's StaticHandler component (versions 4.0.0–4.5.23 or 5.0.0–5.0.6) by examining HTTP response headers (e.g., Server headers) or known deployment patterns.
2. Identify a valid static resource: Send a normal request to confirm a static file is accessible, e.g., curl http://target/foo/index.html — expect HTTP 200.
3. Craft the poisoning URI: Construct a URI that inserts a percent-encoded path traversal segment (bar%2F..%2F) before the target filename, e.g., http://target/foo/bar%2F..%2Findex.html.
4. Send the poisoning request: Issue the crafted request: curl 'http://target/foo/bar%2F..%2Findex.html' — the server returns HTTP 404 and caches the path as non-existent.
5. Verify cache corruption: Re-request the legitimate resource: curl http://target/foo/index.html — the server now returns HTTP 404 due to the poisoned cache entry, denying access to all subsequent legitimate users until the cache is cleared or the service restarts (Github Issue, Vert.x PR).

• Network: HTTP requests containing percent-encoded path traversal sequences such as %2F..%2F in URI paths targeting static file endpoints (e.g., GET /foo/bar%2F..%2Findex.html).
• Logs: Web server or Vert.x access logs showing requests with encoded sequences like %2F..%2F followed by HTTP 404 responses for resources that were previously accessible; subsequent legitimate requests to the same resource also returning 404.
• Application Behavior: Sudden and persistent HTTP 404 errors for static assets (CSS, JS, images) that were previously served correctly, without any file system changes — a strong indicator of cache poisoning rather than missing files (Github Issue).

The fix is available in Eclipse Vert.x Core versions 4.5.24 (for the 4.x branch) and 5.0.7 (for the 5.x branch); users should upgrade io.vertx:vertx-core to these versions or later. As an immediate workaround without upgrading, disable the Static Handler cache in application code: StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);. IBM has released patches for affected products including IBM Event Processing and IBM watsonx Orchestrate — refer to the respective IBM security bulletins for version-specific guidance (Github Advisory, IBM Event Processing, IBM watsonx).

The vulnerability was quickly picked up by downstream projects including Keycloak, Apache Spark, Eclipse Che, and Gravitee, all of which issued dependency updates to pull in the patched Vert.x Core version. Red Hat issued multiple security advisories (RHSA-2026:3890, RHSA-2026:3951, and others) addressing the vulnerability in their product portfolio. The Quarkus project also released version 3.27.3 incorporating the fix. Community discussion on GitHub was active, with multiple projects filing automated CVE detection issues and tracking remediation (Vert.x PR, IBM Event Processing).