Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:18:22.213Z",
  "pubdate": "2026-08-18T21:18:22.213Z",
  "executiveSummary": "An easily exploitable security vulnerability has been identified within the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically affecting version 4.5.0. This flaw allows an unauthenticated remote attacker possessing network access via the HTTP/2 protocol to compromise the affected Helidon instance without requiring any user interaction or prior privileges.\nSuccessful exploitation of this vulnerability manifests through two primary security impacts: unauthorized read access to a subset of data accessible by the Helidon application, leading to a breach of confidentiality, and the capacity to induce a partial denial of service (partial DOS) condition, thereby compromising system availability.\nGiven that the attack vector is network-based with low attack complexity and zero authentication or privilege requirements, the risk profile of this vulnerability is significant for deployments running the unsupported version 4.5.0. The CVSS 3.1 base score is calculated at 6.5, emphasizing the necessity for prompt administrative awareness, defensive monitoring of HTTP/2 traffic vectors, and implementation of available vendor patches or compensating controls.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0, specifically handling network traffic processed via the HTTP/2 protocol. The root cause stems from improper input validation or state management within the HTTP/2 protocol implementation of the web server, which fails to securely parse or manage specific protocol framing sequences or streams.\nExploitation is conducted remotely over the network by an unauthenticated adversary. Because the attack complexity is rated as low and requires no user interaction or privileges, an attacker can directly target the HTTP/2 listener exposed by the Helidon Imperative Web Server. By crafting malicious or malformed HTTP/2 requests, frames, or streams, the attacker interacts with the vulnerable parsing logic of the component.\nThe step-by-step attack flow begins with the attacker establishing an HTTP/2 connection to the exposed network port of the Helidon instance. The attacker then transmits specialized HTTP/2 payloads designed to trigger the underlying flaw in the Imperative Web Server. Upon processing these frames, the application state is improperly handled, allowing the attacker to bypass access controls concerning a subset of application-accessible data, resulting in unauthorized confidentiality disclosure. Concurrently or alternatively, the malicious input can exhaust resources or disrupt processing threads, leading to a partial denial of service condition that impairs the availability of the Helidon server.\nThe post-exploitation impact includes the potential exposure of sensitive application data accessible through the compromised subset and degraded service stability. The affected version is strictly restricted to Helidon 4.5.0, and the attack vector relies exclusively on network exposure via the HTTP/2 protocol."
}