Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:26.680Z",
  "pubdate": "2026-08-18T21:18:26.680Z",
  "executiveSummary": "A vulnerability has been identified within the Helidon product of Oracle Fusion Middleware, specifically affecting the Imperative Web Server component in version 4.5.1. This vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the availability of the targeted system. Successful exploitation of this flaw can result in an unauthorized ability to cause a complete denial of service (DoS), characterized by application hangs or frequently repeatable crashes. The vulnerability is classified with a CVSS 3.1 Base Score of 7.5, reflecting a high severity impact solely on system availability, with no direct confidentiality or integrity impacts. The attack vector is strictly network-based, requiring low attack complexity with no privileges or user interaction required. Consequently, any remote threat actor capable of establishing an HTTP connection to the exposed service can initiate an attack. The risk implications are significant for environments running the affected version, as unexpected application crashes or resource exhaustion can severely disrupt dependent services and business operations. Remediation requires addressing the vulnerable component within the specified software deployment.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Helidon version 4.5.1. The root cause stems from improper handling or processing of incoming HTTP requests, which allows malicious or malformed network traffic to trigger resource exhaustion, thread blocking, or unhandled exceptions leading to process termination. The affected component is exposed directly over the network via the HTTP protocol, making it accessible to any external entity capable of routing packets to the target endpoint. Exploitation does not require authentication or user interaction, and the low attack complexity indicates that the flaw can be reliably triggered without advanced reconnaissance or specialized conditions. The attack flow commences when an unauthenticated threat actor transmits a specially crafted HTTP payload or a sequence of specific requests to the listening Helidon web server port. Upon receiving the input, the Imperative Web Server fails to properly validate, sanitize, or bound the request processing lifecycle. This failure induces a state of thread starvation, excessive CPU or memory consumption, or triggers a fatal runtime exception that the application fails to catch gracefully. As a result, the server process enters an unresponsive hang state or terminates abruptly, causing a complete denial of service for legitimate users. Because the crash condition is described as frequently repeatable, an attacker can continuously script the payload delivery to maintain a persistent disruption of the targeted Helidon instance. Post-exploitation impact is limited to availability degradation; the vulnerability does not inherently grant remote code execution, privilege escalation, or unauthorized access to sensitive data stores residing behind or managed by the application server."
}