Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:21.533Z",
  "pubdate": "2026-08-18T21:18:21.533Z",
  "executiveSummary": "An easily exploitable vulnerability affecting the Imperative Web Server component of Oracle Fusion Middleware (Helidon version 4.5.0) allows unauthenticated remote attackers with network access via HTTP/2 to compromise the target system.\nSuccessful exploitation of this flaw leads to a complete Denial of Service (DoS), characterized by an application hang or a frequently repeatable crash of the Helidon runtime.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.5, reflecting a high impact on system availability with zero impact on confidentiality and integrity.\nAttackers require no privileges and no user interaction, relying solely on network connectivity using the HTTP/2 protocol to deliver the exploit payload.\nRisk implications include severe service disruption and potential operational downtime for enterprise applications relying on the affected Helidon version.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Helidon version 4.5.0, specifically handling network traffic processed via the HTTP/2 protocol.\nThe root cause stems from improper handling of specific HTTP/2 network sequences or frames by the server implementation, leading to resource exhaustion, thread blocking, or unhandled exceptions that crash the runtime environment.\nExploitation is conducted remotely over the network without requiring any authentication or prior system privileges. An unauthenticated attacker establishes an HTTP/2 connection to the vulnerable Helidon endpoint and transmits a maliciously crafted sequence of HTTP/2 frames designed to trigger the flaw.\nThe attack flow proceeds as follows: 1) The attacker initiates a standard TCP connection and negotiates the HTTP/2 protocol via ALPN or direct upgrade. 2) The attacker sends specially formatted or excessive HTTP/2 control frames or request streams to the Imperative Web Server. 3) The vulnerable parsing or processing logic fails to properly validate or handle the incoming data structure. 4) This failure triggers either an infinite loop resulting in a thread hang or a fatal exception resulting in an immediate repeatable crash of the Helidon instance.\nThe payload behavior focuses entirely on availability disruption, causing the affected service to become unresponsive or terminate abruptly, thereby denying legitimate users access to the application."
}