Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:20.620Z",
  "pubdate": "2026-08-18T21:18:20.620Z",
  "executiveSummary": "A denial of service vulnerability exists in the Helidon product of Oracle Fusion Middleware, specifically within the Imperative Web Server component.\nThe vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the affected system, resulting in an unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete denial of service (DoS).\nThe affected supported version is 3.2.19.\nThis security flaw presents significant operational risk due to the potential disruption of service availability.\nThe exploitation vector is network-based requiring low attack complexity, with no privileges or user interaction required.\nThe CVSS 3.1 base score is 7.5, reflecting impacts exclusively on system availability.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.19.\nThe root cause permits unauthenticated remote threat actors to leverage standard HTTP interactions to exhaust system resources or trigger anomalous execution states.\nNetwork exposure is enabled by default for the web server component, exposing the vulnerable endpoint directly to remote clients over HTTP protocols.\nExploitation requires no prior authentication, low attack complexity, and zero user interaction (AV:N/AC:L/PR:N/UI:N).\nThe attack flow proceeds as follows: an unauthenticated attacker transmits maliciously crafted HTTP requests over the network to the Helidon Imperative Web Server.\nUpon processing these requests, the vulnerable component encounters conditions that induce application hangs or repeatedly crash the runtime environment.\nThe payload behavior forces a complete disruption of service availability (A:H), halting normal application request handling without impacting confidentiality or integrity.\nPost-exploitation impact is limited to the complete denial of service of the affected Helidon instance, requiring administrative intervention or service restarts to restore functionality."
}