# io.vertx:vertx-web (Maven) vulnerabilities

7 known vulnerabilities (2 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/io.vertx/vertx-web

## Advisories (7)

### [CVE-2025-11965](https://cve.now/CVE-2025-11965): In Eclipse Vert.x versions \[4.0.0, 4.5.21\] and \[5.0.0, 5.0.4\], a StaticHandler configuration for restricting access to hidden files fails…

- Severity: Medium 6.3
- Published: Oct 22, 2025
- Affected: fixed in 4.5.22; from 5.0.0, fixed in 5.0.5.

### [CVE-2025-11966](https://cve.now/CVE-2025-11966): In Eclipse Vert.x versions \[4.0.0, 4.5.21\] and \[5.0.0, 5.0.4\], when "directory listing" is enabled, file and directory names are inserted…

- Severity: Low 2.3
- Published: Oct 22, 2025
- Affected: fixed in 4.5.22; from 5.0.0, fixed in 5.0.5.

### [CVE-2023-24815](https://cve.now/CVE-2023-24815): Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web

- Severity: Medium 4.8
- Published: Feb 9, 2023
- Affected: from 4.0.0, fixed in 4.3.8.

### [CVE-2020-35217](https://cve.now/CVE-2020-35217): Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification.

- Severity: Unrated
- Published: Jan 20, 2021
- Affected: from 4.0.0-milestone1, fixed in 4.0.0-milestone5; from 4.0.0-milestone2, fixed in 4.0.0-milestone5; from 4.0.0-milestone3, fixed in 4.0.0-milestone5; from 4.0.0-milestone4, fixed in 4.0.0-milestone5.

### [CVE-2019-17640](https://cve.now/CVE-2019-17640): In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5…

- Severity: Unrated
- Published: Oct 15, 2020
- Affected: from 3.0.0, fixed in 3.9.4.

### [CVE-2018-12542](https://cve.now/CVE-2018-12542): In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a…

- Severity: Unrated
- Published: Oct 10, 2018
- Affected: from 3.0.0, fixed in 3.5.4.

### [CVE-2018-12540](https://cve.now/CVE-2018-12540): In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form…

- Severity: Unrated
- Published: Jul 12, 2018
- Affected: from 3.0.0, fixed in 3.5.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/io.vertx:vertx-web
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.