CVE-2019-17640: Eclipse Vert.x

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.

Affected products

• Eclipse Vert.x: from 3.4.0, up to and including 3.9.4; version 4.0.0 only

Published 2020-10-15. Last modified 2026-06-17.