Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:21.180Z",
  "pubdate": "2026-08-18T21:18:21.180Z",
  "executiveSummary": "An easily exploitable vulnerability affects the Oracle Fusion Middleware Helidon product, specifically within the Imperative Web Server component. The vulnerability impacts version 4.5.0 of the software.\nThis security flaw allows an unauthenticated remote attacker with network access via the HTTP/2 protocol to compromise the targeted Helidon instance. Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible by Helidon, posing significant risks to confidentiality.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.5 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating that network attack vector, low attack complexity, and zero privileges or user interaction are required to achieve unauthorized data access.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0.\nThe root cause involves inadequate handling or improper validation of incoming HTTP/2 protocol traffic, which allows unauthenticated remote entities to bypass standard access controls over the network.\nAttackers leverage network access to send specially crafted HTTP/2 requests directly to the vulnerable Helidon web server instance.\nBecause the attack vector is network-based (AV:N) and requires low attack complexity (AC:L) with no privileges (PR:N) or user interaction (UI:N), an adversary can initiate the exploitation sequence without prior authentication.\nUpon transmitting the malicious HTTP/2 payload, the vulnerable component fails to properly restrict access, enabling the attacker to interact with the underlying system resources and bypass security boundaries.\nThe post-exploitation impact is strictly localized to confidentiality (C:H), resulting in unauthorized exposure of critical data or complete access to all data accessible through the Helidon runtime environment, while integrity (I:N) and availability (A:N) impacts remain unaffected."
}