Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:18:26.227Z",
  "pubdate": "2026-08-18T21:18:26.227Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically affecting version 4.5.3. This vulnerability allows an unauthenticated remote attacker with network access via the HTTP protocol to compromise the availability of the target system. Successful exploitation results in a partial denial of service condition against the affected Helidon instance. The vulnerability carries a CVSS 3.1 Base Score of 5.3, with an impact strictly limited to the availability metric (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). The attack complexity is low, requiring no user interaction, privileges, or prior authentication, making it accessible to any network-adjacent or remote malicious actor capable of establishing an HTTP connection to the service. The primary risk implication is service degradation or partial disruption, which can impact application uptime and resource availability for legitimate users.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.3. The root cause stems from improper handling or processing of incoming HTTP traffic by the web server, allowing specially crafted requests to exhaust or disrupt operational resources. Because the vulnerability is exposed over the network via the HTTP protocol, any remote attacker can initiate the attack vector without the need for authentication or prior system access. The attack flow begins when the unauthenticated attacker transmits malicious or malformed HTTP requests to the listening ports of the vulnerable Helidon Imperative Web Server. Due to low attack complexity, the server processes these incoming requests in a manner that triggers the underlying flaw in the component's request handling logic. As the server attempts to parse or service the payload, it encounters resource constraints or execution inefficiencies that lead to a partial denial of service state. The payload behavior is designed to degrade the performance or availability of the affected service instance rather than achieve remote code execution, privilege escalation, or data exfiltration. Consequently, post-exploitation impact is confined strictly to availability disruption, preventing the application from fully responding to legitimate client requests while maintaining confidentiality and integrity boundaries. No special privileges or user interaction are required to successfully execute this network-based attack against the supported version 4.5.3."
}