Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:18:24.250Z",
  "pubdate": "2026-08-18T21:18:24.250Z",
  "executiveSummary": "An easily exploitable security vulnerability has been identified within the Helidon product of Oracle Fusion Middleware, specifically residing in the Imperative Web Server component.\nThe vulnerability affects the supported version 4.5.0 and can be leveraged by an unauthenticated remote attacker with network access via the HTTP protocol.\nSuccessful exploitation of this flaw does not require user interaction or elevated privileges, lowering the barrier for potential malicious actors.\nThe security impact encompasses unauthorized read access to a subset of data accessible by Helidon, compromising confidentiality, alongside an unauthorized capability to induce a partial denial of service (partial DoS), impacting system availability.\nWith a CVSS 3.1 Base Score of 6.5, this issue presents significant operational and security risks, necessitating prompt defensive attention to prevent unauthorized data exposure and service degradation within affected deployments.",
  "technicalDetails": "The vulnerability exists within the Imperative Web Server component of Oracle Helidon version 4.5.0.\nThe attack vector is network-based via HTTP, meaning that any remote adversary capable of routing traffic to the target Helidon instance can initiate the attack path without requiring prior authentication or valid session credentials.\nThe attacker capabilities involve leveraging specifically crafted HTTP requests to interact with the vulnerable Imperative Web Server component.\nUpon reaching the vulnerable component, the improperly handled HTTP payload triggers unintended processing logic, leading to two distinct negative outcomes.\nFirst, the breach of confidentiality occurs when the flawed execution path exposes data structures or resources that should otherwise be restricted, granting the attacker unauthorized read access to a subset of Helidon accessible data.\nSecond, the degradation of availability occurs when the payload induces resource exhaustion or processing hangs within the Imperative Web Server, resulting in a partial denial of service condition.\nThe step-by-step attack flow begins with the unauthenticated threat actor establishing an HTTP connection to the exposed network port of the Helidon instance running version 4.5.0.\nThe actor then transmits the malicious HTTP payload designed to target the Imperative Web Server.\nThe server processes the input without adequate validation or restriction, resulting in the unauthorized disclosure of sensitive data returned in the response headers or body, and simultaneously causing functional instability or resource contention that manifests as a partial denial of service.\nNo privilege requirements or user interaction are necessary to execute this attack sequence, highlighting the exposure of the network-facing component."
}