-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.vertx:vertx-core | maven | < 4.5.24 | 4.5.24 |
Miggo AIRoot Cause AnalysisThe analysis of the provided patch commit d007e7b418543eb1567fe95cf20f5450a5c2d047 clearly points to a flaw in the removeDots function within the io.vertx.core.http.impl.HttpUtils class. The vulnerability description explains that specially crafted request URIs can manipulate the Vert.x Web static handler cache, leading to a denial of service. The commit message explicitly states that HttpUtils#removeDots does not properly handle a rule from RFC3986 for path segment normalization. The code change itself confirms this: the logic for handling "/.." sequences was corrected to properly truncate the output buffer even when no "/" is present. This prevents the incorrect path normalization that leads to the cache poisoning vulnerability. Therefore, the io.vertx.core.http.impl.HttpUtils.removeDots function is the direct source of the vulnerability.
io.vertx.core.http.impl.HttpUtils.removeDotssrc/main/java/io/vertx/core/http/impl/HttpUtils.java