Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:22.883Z",
  "pubdate": "2026-08-18T21:18:22.883Z",
  "executiveSummary": "A remotely exploitable Denial of Service vulnerability affects the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.19. This security flaw enables unauthenticated malicious actors with network connectivity via HTTP to compromise the availability of the affected system without requiring user interaction or prior privileges.\nSuccessful exploitation of this vulnerability directly impacts system availability by inducing a complete system hang or a frequently repeatable application crash. The resulting Denial of Service disrupts dependent services and operations managed by the Helidon runtime.\nWith a CVSS 3.1 Base Score of 7.5 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the risk profile is considered high due to the low attack complexity and the absence of authentication prerequisites. Attackers can remotely target the HTTP listener exposed by the Imperative Web Server to repeatedly trigger the disruption condition.\nRemediation requires applying official patches or updates provided by the vendor for the affected version, as no native mitigation exists beyond restricting network access and applying vendor-supplied updates.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of the Helidon product, specifically impacting version 3.2.19. The root cause stems from improper handling or parsing of incoming HTTP traffic processed by the web server component.\nThe attack vector is network-based (AV:N), allowing any unauthenticated attacker (PR:N, UI:N) with standard network access to transmit malformed or specially crafted HTTP requests to the target service. The attack complexity is rated as low (AC:L), meaning no specialized conditions or race conditions are required for successful exploitation.\nThe attack flow proceeds as follows: First, the attacker establishes a standard network connection over HTTP to the listening port of the Helidon Imperative Web Server. Second, the attacker transmits a malicious HTTP payload designed to trigger the flaw within the request processing logic of the component. Third, upon receiving and processing the payload, the vulnerable component encounters an unhandled exception, resource exhaustion, or deadlock state. This causes the application thread pool or process to hang or crash completely.\nThe scope of the vulnerability is unchanged (S:U), meaning the impact is strictly confined to the vulnerable Helidon component itself. Confidentiality (C:N) and Integrity (I:N) are not impacted, as the vulnerability does not allow unauthorized data access, modification, or arbitrary code execution.\nThe primary impact is localized strictly to Availability (A:H), resulting in a complete Denial of Service characterized by application hangs or repeatable crashes that require administrative intervention to restore service functionality."
}