Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:18:17.443Z",
  "pubdate": "2026-08-18T21:18:17.443Z",
  "executiveSummary": "A denial of service vulnerability has been identified within the Helidon product of Oracle Fusion Middleware, specifically affecting the Imperative Web Server component in version 3.2.18. This security flaw enables unauthenticated malicious actors with network connectivity via the HTTP protocol to execute remote attacks against targeted Helidon instances without requiring any user interaction or prior privileges.\nThe primary risk associated with this vulnerability is the compromise of system availability, leading directly to a partial denial of service condition for the affected application framework. Successful exploitation impairs the normal operational capabilities of the web server, potentially disrupting dependent services and business workflows.\nThe vulnerability is characterized by low attack complexity and does not mandate specialized attacker capabilities beyond standard network access, making it easily exploitable over the wire. Organizations utilizing the impacted Oracle Fusion Middleware component face availability risks if exposed to untrusted networks.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.18. The root cause pertains to insufficient handling of incoming HTTP traffic or specific malformed protocol interactions processed by the server, leading to resource exhaustion or application instability.\nAttackers exploit this vulnerability remotely over the network by sending crafted HTTP requests directly to the listening Helidon service. Because the vulnerability requires no authentication and no user interaction, an unauthenticated client can initiate the attack flow unilaterally.\nThe step-by-step attack flow involves the adversary establishing a standard network connection to the targeted HTTP endpoint exposed by the Helidon Imperative Web Server. The attacker transmits the malicious payload designed to trigger the underlying flaw in request processing. Upon receipt and processing of the input by the vulnerable component, the application encounters an error state or excessive resource consumption pattern that disrupts normal request handling.\nThis behavior results in a partial denial of service (partial DOS), impacting the availability vector as defined by the CVSS 3.1 base score of 5.3 with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The confidentiality and integrity of the system remain uncompromised, as the scope is unaltered and no unauthorized data access or modification capabilities are granted through this specific vector."
}