EUVD-2026-62095
GHSA-9596-wc5v-9gxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Helidon 1.4.20 HTTP endpoint
-
DeliverySend crafted HTTP request to Imperative Web Server
-
ExploitTrigger hang or crash condition
-
ExecutionService becomes unavailable
-
ImpactRepeat to prevent recovery
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Oracle Helidon 1.4.20 Imperative Web Server. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network accessibility with no credentials, no privilege escalation prerequisite, and no victim interaction required. The primary limiting factor is version specificity: only Helidon 1.4.20 is cited as affected, and the vulnerable component is the Imperative Web Server model specifically - deployments using only the Reactive (SE) model may not be affected, though this is not confirmed by the advisory. Network exposure of the HTTP port is required; instances not reachable from attacker-controlled networks are not exploitable. |
| Impact | CVSS 7.5 is high severity and the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates maximum exploitation ease: network-reachable, no credentials, no user interaction, and low attack complexity. Impact is availability-only - confidentiality and integrity are unaffected, limiting the blast radius to service disruption rather than data breach or lateral movement. No EPSS score was provided in the intelligence data, so statistical exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no public POC has been identified, suggesting active exploitation is not yet widespread. Despite low observable threat activity, the PR:N/AC:L combination means any exposed Helidon 1.4.20 instance could be taken offline by an unskilled attacker with trivial effort. In containerized or microservices environments, repeated crashes could cascade if liveness probes and orchestration restart loops are not properly configured. The missing CWE is a gap - without knowing the root cause, assessing whether mitigations like input filtering are effective is uncertain. |
| Exploit ScenarioDerived | An unauthenticated remote attacker identifies a Helidon 1.4.20 Imperative Web Server instance exposed on the network and sends specially crafted HTTP requests that trigger a hang or repeatable crash of the service. Because attack complexity is low and no credentials are required, this can be scripted and automated trivially. No public POC has been identified at time of analysis, but the low bar for exploitation means independent discovery is plausible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Remote unauthenticated denial-of-service in Oracle Helidon 1.4.20 allows network-accessible attackers to crash or indefinitely hang the Imperative Web Server via HTTP, with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivially low exploitation complexity against exposed instances. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of network accessibility and zero prerequisites makes this a realistic operational risk for any deployment of the affected version.
RemediationAI
Consult and apply the Oracle Critical Patch Update for August 2026 at https://www.oracle.com/security-alerts/cspuaug2026.html to remediate this vulnerability. An exact patched version number has not been independently confirmed from the available data - administrators should verify the target upgrade version directly from the Oracle advisory before patching. As compensating controls pending patching, consider placing a reverse proxy or API gateway in front of Helidon services with HTTP request rate-limiting and connection throttling configured, which can reduce the impact of malformed or high-volume triggering requests; note this adds a network hop and may affect latency. Restricting network-level access to Helidon's HTTP port to trusted client IP ranges via firewall rules will limit the attack surface, though this may not be feasible in public-facing deployments. Kubernetes or container orchestration liveness probes with aggressive restart policies can reduce mean downtime from crash exploitation but do not prevent the vulnerability from being triggered.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Helidon is Oracle's open-source Java microservices framework, offered in two programming models: Reactive (SE) and Imperative (MP). The affected component - the Imperative Web Server - provides synchronous, blocking HTTP server capabilities typically used in MicroProfile-compatible microservices. The affected version is specifically 1.4.20 of the Helidon product line within Oracle Fusion Middleware. No CWE identifier was provided, which leaves the precise root cause class unconfirmed; however, the DoS outcome (hang or frequently repeatable crash) is consistent with CWE classes such as CWE-400 (Uncontrolled Resource Consumption), CWE-835 (Infinite Loop), or CWE-20 (Improper Input Validation) in HTTP request parsing. No CPE string was supplied in the available intelligence data, so version scoping relies solely on the Oracle advisory.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network HTTP DoS requiring no auth or interaction; only availability impacted - AV:N, PR:N, A:H are all consistent with the description and vendor vector.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Helidon 1.4.20 contains a high-severity remote denial-of-service vulnerability allowing unauthenticated network attackers to crash or hang the Imperative Web Server with no authentication or user interaction required. With no vendor patch currently available and no public exploit identified at time of analysis, organizations running this middleware version face immediate operational risk to service availability.
No vendor-released patch identified at time of analysis. Interim mitigations include: network segmentation restricting access to affected Helidon instances, Web Application Firewall rules to throttle or block HTTP DoS traffic, real-time monitoring and alerting for abnormal traffic patterns and server resource exhaustion, and load balancer connection limits to prevent service saturation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB