Critical
Security advisory
In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-17640
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:52 UTC · Revision 1
Source evidence
In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.
osv:CVE-2019-17640
Complete source record
{
"id": "ebeb5d696a6f8b7d875315e80cc4bf35d8c22e2902ac139f6260a6db474980d5",
"url": "https://osv.dev/vulnerability/CVE-2019-17640",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-17640",
"summary": "In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.",
"evidence": "osv:CVE-2019-17640",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2019-17640",
"aliases": [
"CVE-2019-17640",
"GHSA-vjw7-6gfq-6wf5"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/eclipse-vertx/vert.x",
"type": "GIT",
"events": [
{
"introduced": "05683b353b8ad53d28e9a70f0f0bfc2ce36c083c"
},
{
"last_affected": "d4490fed7871b55c3cefa459f622fb22cfead951"
},
{
"introduced": "3daea80a20324bb19e97c8455c648efa62fba104"
},
{
"last_affected": "95372a1f8a7ea235415ce746eda91e0243a59307"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4.0"
},
{
"last_affected": "3.9.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-beta1"
},
{
"last_affected": "4.0.0-beta1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-beta2"
},
{
"last_affected": "4.0.0-beta2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-beta3"
},
{
"last_affected": "4.0.0-beta3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone1"
},
{
"last_affected": "4.0.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone2"
},
{
"last_affected": "4.0.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone3"
},
{
"last_affected": "4.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone4"
},
{
"last_affected": "4.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone5"
},
{
"last_affected": "4.0.0-milestone5"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"4.0.0-beta1",
"4.0.0-beta2",
"4.0.0-beta3",
"4.0.0-milestone1",
"4.0.0-milestone2",
"4.0.0-milestone3",
"4.0.0-milestone4",
"4.0.0-milestone5",
"3.9.4",
"3.9.3",
"3.9.2",
"3.9.1",
"3.9.0",
"3.8.5",
"3.8.4",
"3.8.3",
"3.8.2",
"3.8.1",
"3.8.0",
"3.7.1",
"3.7.0",
"3.6.3",
"3.6.2",
"3.6.1",
"3.6.0",
"3.6.0.CR2",
"3.6.0.CR1",
"3.5.1",
"3.5.0",
"3.5.0.Beta1",
"3.4.2",
"3.4.1",
"3.4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/eclipse-vertx/vertx-sql-client",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "df20a720ec8d3b50e8b4ca47869d0e1c8cf31a8a"
},
{
"introduced": "b6b141720e1f8150d90df89d4f49d7bbbe848af4"
},
{
"last_affected": "27fe6ddb558ce3a8acf2782d8531f671ef2d4ddb"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4.0"
},
{
"last_affected": "3.9.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-beta1"
},
{
"last_affected": "4.0.0-beta1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-beta2"
},
{
"last_affected": "4.0.0-beta2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-beta3"
},
{
"last_affected": "4.0.0-beta3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone1"
},
{
"last_affected": "4.0.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone2"
},
{
"last_affected": "4.0.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone3"
},
{
"last_affected": "4.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone4"
},
{
"last_affected": "4.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone5"
},
{
"last_affected": "4.0.0-milestone5"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"4.0.0-beta1",
"4.0.0-beta2",
"4.0.0-beta3",
"4.0.0-milestone1",
"4.0.0-milestone2",
"4.0.0-milestone3",
"4.0.0-milestone4",
"4.0.0-milestone5",
"3.9.4",
"3.9.3",
"3.9.2",
"3.9.1",
"3.9.0",
"3.8.5",
"3.8.4",
"3.8.3",
"3.8.2",
"3.8.1",
"3.8.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/vert-x3/vertx-web",
"type": "GIT",
"events": [
{
"introduced": "8a11acc912accf4c0661f5c56f1cd387f5200718"
},
{
"last_affected": "1258a682e0ec6a695da8b05063afb0ee57a503c9"
},
{
"introduced": "4b8bd2f1053800a3e79152f2f10026942554a44f"
},
{
"last_affected": "2e72faef41bec6162023aca898678929064870cd"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4.0"
},
{
"last_affected": "3.9.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-beta1"
},
{
"last_affected": "4.0.0-beta1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-beta2"
},
{
"last_affected": "4.0.0-beta2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-beta3"
},
{
"last_affected": "4.0.0-beta3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone1"
},
{
"last_affected": "4.0.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone2"
},
{
"last_affected": "4.0.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone3"
},
{
"last_affected": "4.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone4"
},
{
"last_affected": "4.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0-milestone5"
},
{
"last_affected": "4.0.0-milestone5"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"4.0.0-beta1",
"4.0.0-beta2",
"4.0.0-beta3",
"4.0.0-milestone1",
"4.0.0-milestone2",
"4.0.0-milestone3",
"4.0.0-milestone4",
"4.0.0-milestone5",
"3.9.4",
"3.9.3",
"3.9.2",
"3.9.1",
"3.9.0",
"3.8.5",
"3.8.4",
"3.8.3-01",
"3.8.3",
"3.8.2",
"3.8.1",
"3.8.0",
"3.7.1",
"3.7.0",
"3.6.3",
"3.6.2",
"3.6.1",
"3.6.0",
"3.6.0.CR2",
"3.6.0.CR1",
"3.5.1",
"3.5.0",
"3.4.2",
"3.4.1",
"3.4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json"
}
}
],
"modified": "2026-10-24T10:50:35.684146681Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33%40%3Ccommits.pulsar.apache.org%3E",
"https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941%40%3Ccommits.servicecomb.apache.org%3E",
"https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511%40%3Ccommits.pulsar.apache.org%3E",
"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E",
"https://lists.apache.org/thread.html/rfd0ebf8387cfd0b959d1e218797e709793cce51a5ea2f84d0976f47d%40%3Ccommits.pulsar.apache.org%3E",
"https://bugs.eclipse.org/bugs/show_bug.cgi?id=567416"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-17640",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442330,
"published_at": "2020-10-15T21:15:11.427+00:00"
}