An attacker can craft a request URI that manipulates the Vert.x Web static handler cache so that legitimate static files are denied with a 404 response. The flaw originates from an improper implementation of the C rule in RFC3986, allowing static file access to be inadvertently blocked. This results in an availability denial for the affected resources but does not grant any code execution or information disclosure.

The vulnerability affects applications built with Eclipse Vert.x Web that use the static handler component with caching enabled. Any version of Vert.x Web using the default static handler configuration is potentially impacted, since the issue resides in the Vert.x Core component used by Vert.x Web. No specific version numbers are listed, so all deployments should review whether the static handler cache is enabled.

The flaw carries a CVSS score of 6.9, indicating medium severity, and the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not cataloged in the CISA KEV list. Exploitation requires only the ability to request URLs on the vulnerable server; no authentication or special privileges are needed. The attacker can simply send a specially crafted URL such as "https://example.com/foo/bar%2F..%2Findex.html" to trigger the denial of access.