Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:24.370Z",
  "pubdate": "2026-08-18T21:18:24.370Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Fusion Middleware Helidon product, specifically localized to the Imperative Web Server component.\nThe flaw allows an unauthenticated remote attacker with network access via the HTTP protocol to compromise the availability of the target system.\nSuccessful exploitation of this security issue results in an unauthorized ability to induce a service hang or a frequently repeatable application crash, culminating in a complete Denial of Service (DoS) condition.\nThe vulnerability is characterized by a CVSS 3.1 Base Score of 7.5, reflecting a high impact exclusively on system availability with no direct confidentiality or integrity compromises.\nExploitation requires no privileges, no user interaction, and low attack complexity, making it a critical availability risk for deployments running the affected version.\nThe sole officially affected supported version identified in the advisory is 4.5.0.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically impacting version 4.5.0.\nFrom an attack vector perspective, the vulnerability is exposed remotely over the network via the HTTP protocol, categorized under CVSS v3.1 as AV:N, indicating that network proximity is the only prerequisite for reaching the vulnerable attack surface.\nThe attack complexity is evaluated as low (AC:L), signifying that an attacker does not need to bypass sophisticated security controls or race complex states to trigger the flaw.\nPrivilege requirements are completely absent (PR:N), and user interaction is not required (UI:N), allowing any anonymous client with network connectivity to initiate the attack sequence.\nThe scope is unchanged (S:U), meaning the vulnerability impacts only the immediate security context of the Helidon web server process rather than downstream or upstream components.\nThe root cause manifests as a failure in resource management or request handling within the Imperative Web Server, which can be triggered by crafted HTTP traffic sent by the attacker.\nDuring the attack flow, the unauthenticated actor transmits malicious or malformed HTTP requests directly to the network-exposed Helidon endpoints.\nUpon processing these specific inputs, the vulnerable component enters an unrecoverable state, such as an infinite loop, thread exhaustion, deadlock, or unhandled exception that forces the application runtime to crash.\nThe payload behavior is designed strictly to disrupt service continuity rather than achieve remote code execution or data exfiltration.\nThe post-exploitation impact is limited to a complete Denial of Service (DoS), characterized by a system hang or a repeatable application crash, requiring administrative intervention to restore service availability."
}