Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:18:22.543Z",
  "pubdate": "2026-08-18T21:18:22.543Z",
  "executiveSummary": "An information disclosure vulnerability has been identified within the Oracle Fusion Middleware product, specifically affecting the Helidon component's Imperative Web Server. This security flaw allows an unauthenticated remote attacker to leverage network access via the HTTP protocol to compromise the confidentiality of the system. Successfully exploiting this vulnerability enables unauthorized read access to a specific subset of data accessible through the Helidon application.\nThe vulnerability carries a CVSS 3.1 Base Score of 5.3, with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, highlighting its network-vector exploitability without requiring user interaction or any prior authentication and privileges. The primary impact is confined to confidentiality, presenting notable risk implications for environments housing sensitive data within the targeted subset. The vulnerability affects version 3.2.19 of the Helidon product, making remediation critical for deployments utilizing this exact iteration.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of the Oracle Helidon product, specifically impacting version 3.2.19. The architectural root cause stems from improper handling or insufficient access controls within HTTP request processing, which inadvertently exposes internal data structures or sensitive resources to external clients. Because the vulnerability is exposed via the network (AV:N), an attacker does not require physical or local access to the underlying host system.\nExploitation of this vulnerability requires low attack complexity (AC:L) and can be executed entirely unauthenticated (PR:N), meaning no valid user credentials or pre-existing privilege levels are necessary to initiate the attack. Furthermore, the attack vector does not rely on user interaction (UI:N), allowing automated scripts or remote tooling to systematically query the vulnerable endpoint. The scope remains unchanged (S:U), restricting the immediate direct impact to the vulnerable Helidon component itself.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts specialized HTTP requests directed at the Imperative Web Server interface of the affected Helidon deployment. Due to the validation and authorization flaws present in version 3.2.19, the web server fails to properly restrict access to the targeted resources. Consequently, the server processes the incoming request and returns a response containing sensitive information that should otherwise be protected. The resulting post-exploitation impact is strictly limited to unauthorized read access (C:L), meaning the attacker cannot execute arbitrary code, modify system data, or induce a denial of service condition against the host through this specific vulnerability vector."
}