Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon and unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T21:18:26.800Z",
  "pubdate": "2026-08-18T21:18:26.800Z",
  "executiveSummary": "An unauthenticated vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. This flaw is easily exploitable remotely over the network via the HTTP/2 protocol without requiring any user interaction or prior authentication privileges. Successful exploitation of this vulnerability allows a malicious actor to compromise the availability and confidentiality of the targeted Helidon instance. The primary impacts include unauthorized read access to a subset of data accessible by Helidon and the capability to induce a complete denial of service through an application hang or a frequently repeatable crash. Given the network-facing nature and low attack complexity, the vulnerability poses significant risk to environments running the affected version, necessitating immediate remediation actions to prevent service disruption and data exposure.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon, specifically affecting version 4.5.0. The root cause stems from improper handling of HTTP/2 protocol frames or connection streams by the web server implementation. Because HTTP/2 multiplexes multiple streams over a single TCP connection and utilizes complex state management, flaws in parsing, stream synchronization, or resource allocation can be triggered remotely by sending maliciously crafted HTTP/2 payloads.\nExploitation requires network access to the target Helidon server utilizing the HTTP/2 protocol. An unauthenticated attacker initiates a connection over the network and transmits specially formatted HTTP/2 frames designed to exploit the weakness in the Imperative Web Server. As the server processes these malformed or resource-intensive frames, it encounters an unhandled exception, enters an infinite loop, or exhausts critical system resources. This leads directly to a complete denial of service state characterized by application hangs or repeated crashes.\nConcurrently, the processing anomalies introduced during the malformed HTTP/2 transaction handling can allow the attacker to bypass access controls or induce memory disclosure conditions, granting unauthorized read access to a subset of data accessible within the Helidon runtime context. The attack vector is strictly network-based (AV:N), with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N). The scope remains unchanged (S:U), while the impact metrics quantify a low confidentiality breach (C:L) and a high availability disruption (A:H), resulting in a CVSS 3.1 base score of 8.2."
}