Eclipse Vert.x-Web vulnerabilities

3 CVEs affecting Eclipse Vert.x-Web, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1002, published 2026-01-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-24815, published 2023-02-09. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating…
CVE-2020-35217, published 2021-01-20. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token…
CVE-2026-1002, published 2026-01-15. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper…