Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:48.633Z",
  "pubdate": "2026-08-18T21:17:48.633Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Fusion Middleware Helidon product, specifically affecting the Imperative Web Server component in version 3.2.18. This security flaw allows an unauthenticated remote attacker with network access via the HTTP protocol to compromise the availability of the target system. Successful exploitation of this vulnerability results in an unauthorized condition capable of causing an application hang or a frequently repeatable complete denial of service (DoS) state. The vulnerability carries a CVSS 3.1 Base Score of 7.5, reflecting a high severity impact solely on system availability, with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The attack vector is network-based, requiring low attack complexity, zero privileges, and no user interaction, making it highly accessible to malicious actors seeking to disrupt service operations.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.18. The root cause stems from flaws in how incoming HTTP requests are processed by the server architecture, allowing specially crafted network payloads to trigger resource exhaustion or execution blocks. The exploitation method relies on sending malicious HTTP requests over the network without requiring any prior authentication or administrative privileges. The attack flow begins when an unauthenticated attacker establishes a network connection to the target Helidon instance via the HTTP protocol. The attacker transmits the specifically crafted payload targeting the Imperative Web Server component. Upon receipt, the vulnerable component fails to properly handle the input, leading to thread exhaustion, deadlocks, or unhandled exceptions that cause the application process to hang or repeatedly crash. This results in a complete disruption of service, denying legitimate users access to the application. The attack requires low complexity and can be executed repeatedly to sustain the denial of service state, impacting overall availability while maintaining confidentiality and integrity."
}