A logic error in URI normalization within Vert.x Web allows unauthenticated attackers to poison the StaticHandler cache. By crafting URLs with encoded dot segments, an attacker tricks the server into caching a 404 Not Found response for legitimate files, causing persistent Denial of Service for users until the cache expires or the server restarts.

The CVE-2026-1002 vulnerability, rated CVSS 6.9 (Medium), affects versions 4.0.0 through 4.5.23 and 5.0.0 through 5.0.6. A fix has been committed to address the RFC 3986 interpretation inconsistency. This flaw highlights a common risk in web servers where improper request normalization can lead to security bypasses and service disruption.

Developers should immediately update to Vert.x Web 4.5.24 or 5.0.7. If updating isn't feasible, disabling StaticHandler caching or implementing WAF rules to block encoded dot segments are recommended workarounds. Flushing any upstream caches is also critical to fully remediate poisoned responses.