Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:26.453Z",
  "pubdate": "2026-08-18T21:18:26.453Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.19, posing a significant risk to system availability.\nThe vulnerability allows an unauthenticated remote attacker with network access via the HTTP/2 protocol to compromise the affected application.\nSuccessful exploitation results in an unauthorized ability to cause a hang or a frequently repeatable complete denial of service (DoS) state against the targeted Helidon instance.\nWith a CVSS 3.1 Base Score of 7.5 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, this flaw exclusively impacts availability, requiring no privileges, user interaction, or complex attack conditions.\nThe inherent network exposure of HTTP/2 services combined with low attack complexity makes this vulnerability critical for environments utilizing the specified Helidon version.\nOrganizations running vulnerable deployments must implement targeted remediations to prevent service degradation and complete application halts.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon, specifically affecting version 3.2.19.\nThe root cause stems from flaws in how the HTTP/2 protocol is processed by the server, allowing specially crafted network traffic to exhaust system resources or induce fatal execution states.\nExploitation is achieved over the network via the HTTP/2 protocol without requiring any prior authentication or administrative privileges.\nThe attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring no user interaction (UI:N) and targeting the availability metric scope (S:U).\nDuring an attack, malicious payloads transmitted over HTTP/2 interact improperly with the Imperative Web Server request handling mechanisms.\nThis interaction triggers conditions leading to thread starvation, infinite loops, memory exhaustion, or unhandled exceptions that cause the application process to hang or crash.\nBecause the crash is frequently repeatable, an attacker can continuously disrupt service availability, effectively neutralizing the application's operational capacity.\nThe impact is strictly limited to the availability (A:H) vector, resulting in no direct compromise of confidentiality or integrity."
}