EUVD-2026-79633
GHSA-22q7-8jfc-2936
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor states network TCP attack needing no credentials or interaction; unauthenticated remote DoS with availability-only impact justifies PR:N and A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Unauthenticated remote denial of service in Oracle Helidon's helidon-webserver component (versions 4.0.0 through 4.5.4) allows any network-reachable attacker to drive the server into a hang or a repeatable crash, fully denying service. The flaw is rated CVSS 7.5 with a network vector and no authentication or user interaction required, and Oracle lists it in its Fusion Middleware security advisory, making exposure a direct function of whether the Helidon HTTP listener is reachable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only prerequisite is network reachability to the Helidon web server TCP listener; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attacker needs no account, no credentials, and no victim interaction, and Oracle's description explicitly states the attacker has network access via TCP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a near-ideal attack profile for an availability attack: reachable over the network, low complexity, no privileges, no user interaction, and complete loss of availability in the affected component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply the Oracle Fusion Middleware security update referenced at https://www.oracle.com/security-alerts/cspusep2026.html and move off the affected 4.0.0-4.5.4 range to the fixed Helidon release specified in that advisory (Oracle CPU advisories list the precise patched artifact versions per product). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today