Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:16.393Z",
  "pubdate": "2026-08-18T21:18:16.393Z",
  "executiveSummary": "A vulnerability has been identified within the Helidon product of Oracle Fusion Middleware, specifically within the Imperative Web Server component. This security flaw enables unauthenticated remote threat actors with network access via HTTP to compromise the affected software, leading to a complete Denial of Service (DoS) condition. Successful exploitation of this vulnerability manifests as an unauthorized capability to induce an application hang or a frequently repeatable crash of the Helidon instance, thereby severely impacting service availability.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.5 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, highlighting that confidentiality and integrity are unaffected, but availability impact is high. The attack vector is strictly network-based, featuring low attack complexity, requiring no privileges, and demanding zero user interaction. The scope remains unchanged (S:U). The sole affected supported version specified is 1.4.20. Organizations running this specific version face significant operational risk due to the ease of exploitability and the potential for repeated service disruption without requiring prior authentication or internal network positioning.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Helidon version 1.4.20. The root cause allows an unauthenticated remote attacker to transmit maliciously crafted HTTP requests over the network to the vulnerable endpoint, triggering abnormal behavior within the server's request handling logic. Because the Imperative Web Server lacks adequate input validation, bounds checking, or resource management controls for these specific inputs, the processing of the payload leads to resource exhaustion, an unhandled exception, or an infinite loop resulting in thread starvation or process termination.\nThe attack flow proceeds as follows: First, the remote attacker identifies an exposed Helidon instance running version 1.4.20 via HTTP. Second, the attacker crafts a specialized HTTP request designed to target the Imperative Web Server component. Third, the attacker transmits this payload over the network without requiring any form of authentication or authorization credentials. Fourth, upon receiving and attempting to process the malformed or destabilizing request, the Imperative Web Server encounters a fatal condition within its execution path. This directly causes the application to either hang indefinitely, failing to respond to subsequent legitimate requests, or crash entirely, resulting in a complete Denial of Service.\nThe post-exploitation impact is limited to availability disruption; there is no evidence of arbitrary code execution, privilege escalation, or unauthorized data access (confidentiality and integrity impacts are rated as None). However, the repeatable nature of the crash allows malicious actors to continuously disrupt business operations by repeatedly sending the trigger payload, maintaining a persistent outage state until administrative intervention occurs."
}