What is CVE-2026-1002?

CVE-2026-1002 is a medium-severity vulnerability in Eclipse Vert.x-web, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 5.3/10. Published 2026-01-15.

How severe is CVE-2026-1002?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Eclipse Vert.x-web

CVE-2026-1002

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5…

Vulnerability class: HTTP Request Smuggling

EPSS: 0.003 (26.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Eclipse Vert.x-web
Eclipse Vert.x — versions 4.0.0, 5.0.0

Weakness classification (CWE)

CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling)

References

emo@eclipse.org (Patch, patch, Issue Tracking)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (Exploit)

Frequently asked questions

What is CVE-2026-1002?: CVE-2026-1002 is a medium-severity vulnerability in Eclipse Vert.x-web, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 5.3/10. Published 2026-01-15.
How severe is CVE-2026-1002?: Medium severity. CVSS v3 base score is 5.3 out of 10.