Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:25.663Z",
  "pubdate": "2026-08-18T21:18:25.663Z",
  "executiveSummary": "A remotely exploitable denial of service vulnerability has been identified within the Oracle Fusion Middleware Helidon product, specifically affecting the Imperative Web Server component in version 3.2.20.\nThe vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the availability of the target system by triggering a system hang or a frequently repeatable crash.\nWith a CVSS 3.1 Base Score of 7.5 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw presents severe risks to service continuity.\nThe exploitation vector requires low attack complexity and zero privileges or user interaction, enabling remote adversaries to disrupt critical operations entirely.\nSuccessful exploitation directly impacts the availability metric, leading to a complete denial of service condition for deployed Helidon instances.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.20.\nThe flaw stems from inadequate handling of incoming HTTP traffic processed by the network stack of the affected component.\nAn unauthenticated threat actor can leverage this vulnerability remotely over the network using standard HTTP requests without requiring any prior authentication credentials or user interaction.\nThe attack flow begins when the adversary transmits a specially crafted HTTP payload to the vulnerable endpoint exposed by the Helidon Imperative Web Server.\nUpon receipt, the underlying parsing logic or resource management routine fails to properly process the input, resulting in an unhandled exception, infinite loop, resource exhaustion, or deadlock condition.\nThis anomalous state precipitates an immediate application hang or a frequently repeatable crash, terminating the process and rendering the service unavailable.\nThe post-exploitation impact is strictly confined to availability degradation, as the vulnerability does not grant capabilities for unauthorized data confidentiality disclosure or integrity modification.\nThe low attack complexity guarantees that script-kiddies and automated vulnerability scanners can reliably reproduce the crash condition, posing an ongoing availability threat until remediation is applied."
}