EUVD-2026-62170
GHSA-q5p2-4pv3-vrgc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Helidon HTTP endpoint
-
DeliverySend crafted HTTP request to Imperative Web Server
-
ExploitTrigger hang or crash in request processing
-
ExecutionService becomes unavailable
-
ImpactRepeat to sustain outage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for the attack vector itself - exploitation is remote, unauthenticated, and low-complexity against any Helidon 3.2.20 instance running the Imperative Web Server component with HTTP exposed to the network (AV:N/AC:L/PR:N/UI:N). The limiting conditions are: only version 3.2.20 is stated as affected (other versions not confirmed vulnerable); the vulnerability is specific to the Imperative Web Server component - deployments using only the Reactive Web Server may not be affected (not confirmed from available data); and impact is strictly availability-only, with no privilege escalation or data exfiltration possible. Internet-facing deployments are at greatest risk; internal-only deployments behind network controls face reduced realistic risk. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a straightforwardly dangerous denial-of-service: remote, unauthenticated, low-complexity, and fully automatable, meaning a single malicious actor or botnet could repeatedly knock Helidon services offline. The impact is constrained entirely to availability - there is no confidentiality or integrity exposure, which limits the strategic severity for most threat models. No EPSS score was provided in the intelligence feed, so exploitation probability cannot be quantified numerically; however, the combination of AV:N/AC:L/PR:N/UI:N means the automated exploitability is inherently high regardless of EPSS. No KEV listing exists and no POC has been identified, suggesting this has not yet been weaponized. The real-world priority depends heavily on how Helidon 3.2.20 is exposed: internet-facing microservices APIs are significantly higher risk than internal-only deployments. Organizations relying on Helidon for high-availability services (e.g., Oracle Cloud workloads, enterprise APIs) should treat this as a high operational priority despite the availability-only scope. |
| Exploit ScenarioDerived | An unauthenticated attacker on the internet sends a sequence of specially crafted HTTP requests to a publicly exposed Helidon 3.2.20 Imperative Web Server endpoint. The server enters a hang state or crashes, causing a complete service outage. No POC has been identified, but the AV:N/AC:L/PR:N/UI:N vector indicates the attack requires no credentials, no special tooling, and could be scripted trivially. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Denial-of-service in Oracle Helidon 3.2.20 (Imperative Web Server component) allows unauthenticated remote attackers to repeatedly crash or indefinitely hang the server via crafted HTTP requests. The vulnerability is rated CVSS 7.5 with no authentication, no user interaction, and low attack complexity, making it trivially exploitable at scale against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease of exploitation and complete availability impact warrant prompt patching.
RemediationAI
Apply the patch issued by Oracle in the Critical Patch Update (CPU) for August 2026, available via the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. The advisory confirms patch availability, but an exact fixed version number (e.g., 3.2.21 or later) was not independently confirmed from the available intelligence - consult the Oracle advisory directly to obtain the specific patched artifact. Until patching is complete, compensating controls should be evaluated based on deployment context: restrict network access to Helidon's HTTP listener to trusted IP ranges or internal networks only using firewall rules or an API gateway, deploy a rate-limiting reverse proxy (e.g., nginx, HAProxy, or an API gateway) in front of Helidon instances to throttle or drop anomalous request volumes before they reach the vulnerable component, and monitor for sudden spikes in request volume or connection hangs as potential exploitation indicators. Rate limiting adds latency overhead and may impact legitimate burst traffic; IP allowlisting is effective only if all legitimate clients are known in advance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source Java microservices framework, part of Oracle Fusion Middleware, providing both reactive and imperative (blocking/synchronous) web server models. The affected component is specifically the Imperative Web Server - the blocking API variant - in version 3.2.20. The vulnerability is triggered over HTTP, suggesting a flaw in request parsing, connection handling, or resource management within the synchronous request processing pipeline. No CWE was assigned in NVD, so the precise root cause class (e.g., CWE-400 Uncontrolled Resource Consumption, CWE-835 Loop with Unreachable Exit Condition, or CWE-476 Null Pointer Dereference) is not confirmed from available data. The CVSS vector confirms only availability impact, ruling out data exposure or integrity compromise.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
HTTP-based DoS with no authentication or user interaction required; impact is solely availability with no confidentiality or integrity effect, consistent with vendor description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Helidon 3.2.20 contains a denial-of-service vulnerability enabling unauthenticated remote attackers to crash or hang web servers, creating immediate risk to service availability for all exposed instances. No public exploit identified at time of analysis, though the low attack complexity makes exploitation trivial once awareness spreads. No patch is currently available from the vendor, requiring immediate implementation of interim protective controls.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) network-level rate limiting to reduce attack surface; (2) WAF request validation and filtering rules; (3) reverse-proxy request validation and timeout enforcement; (4) comprehensive monitoring and alerting for server hangs with automated failover triggers; (5) load-balanced architecture to distribute requests across multiple instances and absorb individual server crashes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB