Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:26.570Z",
  "pubdate": "2026-08-18T21:18:26.570Z",
  "executiveSummary": "An easily exploitable vulnerability exists in the Helidon product of Oracle Fusion Middleware, specifically within the Imperative Web Server component, affecting version 4.5.1.\nThis vulnerability enables an unauthenticated remote attacker with network access via the HTTP/2 protocol to compromise the affected system.\nSuccessful exploitation of this security flaw results in an unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete Denial of Service (DoS) of the Helidon instance.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.5, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that availability is the sole impacted security property.\nNo user interaction or privileges are required for a successful attack, making network exposure to HTTP/2 the primary vector for exploitation.\nOrganizations utilizing the affected Oracle Helidon version face significant availability risks due to the potential for continuous service disruption.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.1.\nThe flaw manifests specifically in how the application processes incoming network traffic transmitted over the HTTP/2 protocol.\nAttackers can leverage network access to send specially crafted HTTP/2 payloads designed to trigger resource exhaustion, parsing anomalies, or unhandled exceptions within the Imperative Web Server.\nThe step-by-step attack flow begins with the unauthenticated attacker establishing a network connection to the target Helidon instance over the HTTP/2 protocol.\nThe attacker then transmits the malicious HTTP/2 payload to the vulnerable endpoint without requiring any prior authentication or administrative privileges.\nUpon receiving and processing the payload, the Imperative Web Server encounters a fatal state, internal exception, or catastrophic resource lock, failing to gracefully handle the input.\nThis behavior results in either a complete application hang or a frequently repeatable crash of the Helidon runtime.\nThe post-exploitation impact is strictly confined to the availability vector, completely disrupting service availability for legitimate users while maintaining confidentiality and integrity of underlying data."
}