EUVD-2026-62159
GHSA-86c4-m7c4-qc7r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Helidon 4.5.0 HTTP port
-
DeliveryCraft malicious HTTP request
-
ExploitSend request to Imperative Web Server
-
ExecutionTrigger hang or crash in server process
-
ImpactHelidon service denied to legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network-level HTTP access to a Helidon 4.5.0 Imperative Web Server instance - no authentication, no special configuration, and no user interaction are needed (confirmed by CVSS PR:N, AC:L, UI:N, AV:N). The critical limiting condition is version specificity: only Helidon 4.5.0 is confirmed vulnerable; other versions or applications built on the reactive web server component are not confirmed affected. Applications where the Helidon HTTP port is restricted to internal networks or authenticated load balancers face reduced real-world exposure, as the attacker must have direct TCP connectivity to the service. No non-default configuration is required to be vulnerable - the flaw is in the default HTTP request handling path of the Imperative Web Server. |
| Impact | The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the exploitability profile: no privileges, no user interaction, low complexity, and full availability impact on the vulnerable system. The scope is unchanged (S:U), meaning the attack does not pivot to affect adjacent systems directly, limiting blast radius. No EPSS data was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no reported POC, so active in-the-wild exploitation is not confirmed. The impact is purely availability - there is no confidentiality or integrity risk, which reduces urgency for data-sensitive environments. However, for any application where uptime is critical (APIs, microservice backends), an unauthenticated crash-on-demand vulnerability is operationally severe. The version specificity (4.5.0 only) is the primary real-world limiting factor. |
| Exploit ScenarioDerived | An unauthenticated remote attacker identifies an internet- or network-exposed Oracle Helidon 4.5.0 instance and sends a specially crafted HTTP request to the Imperative Web Server endpoint. The malformed or resource-abusing request triggers a hang or crash condition in the server process, rendering the Helidon application unavailable to legitimate clients. The low attack complexity (AC:L) means no special tooling or timing is required; a simple HTTP client is sufficient to reproduce the condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Remote denial-of-service in Oracle Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers to cause a persistent hang or repeated crash of the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no authentication or user interaction required, making this reliably triggerable against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity means operational risk for teams running Helidon 4.5.0 in production microservice environments is meaningful.
RemediationAI
Apply the patch referenced in the Oracle Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. The exact fixed version number is not independently confirmed in the available data and must be obtained directly from the Oracle advisory. Until the patch is applied, deploy a reverse proxy or API gateway (such as nginx or HAProxy) in front of Helidon instances to enforce per-connection and per-IP rate limits, which may reduce the ability to trigger persistent hangs at scale - though a single-connection hang may still succeed. Restrict HTTP access to the Helidon Imperative Web Server to trusted internal network ranges via firewall ACLs, reducing exposure to untrusted sources. Monitor server threads and response latency for anomalies indicative of hang-based exploitation. Note that network-layer controls will not mitigate the root cause and should be treated as temporary compensating controls only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source Java microservices framework offering both reactive (Helidon MP/SE) and imperative programming models. The specifically affected component is the Imperative Web Server in version 4.5.0, which handles HTTP request processing in a synchronous-style threading model. No CWE is provided in the input data, so the exact root cause class is unconfirmed; however, the DoS symptom (hang or repeatable crash via HTTP) is consistent with resource exhaustion (CWE-400), uncontrolled recursion (CWE-674), or improper handling of malformed HTTP input (CWE-20). The 'hang' behavior specifically suggests a thread-blocking or infinite-loop condition rather than a hard crash, which could affect all server threads simultaneously. CPE strings are not provided in the available data.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-exposed HTTP service requires no auth; DoS-only impact with no confidentiality or integrity effect; vendor vector is independently consistent with the description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Helidon 4.5.0 Imperative Web Server contains a critical remote denial-of-service vulnerability affecting any organization running this framework in production, with no available vendor patch. The flaw requires no authentication or user interaction-any internet-exposed instance can be crashed remotely-creating immediate operational risk for microservice-dependent systems. Leadership must prioritize inventory and defensive measures to prevent unplanned service outages.
Network segmentation to restrict Helidon access to internal services only; rate-limiting and connection-timeout configuration on reverse proxies to absorb and throttle denial-of-service attempts; load-balancing with automatic restart capability to improve service resilience; enhanced monitoring for abnormal restarts and resource exhaustion patterns to detect active exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB