EUVD-2026-105989
GHSA-52h7-8gh8-jgg4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain influence over client DNS responses
-
DeliverySend crafted DNS records to round-robin resolver
-
ExploitCorrupt resolved address handling in WebClient
-
ExecutionMisroute requests and tamper with accessible data
-
ImpactCause partial DoS and integrity loss
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only when the target application uses the Helidon WebClient with the round-robin DNS resolver (helidon-webclient-dns-resolver-round-robin) and the attacker can influence the DNS responses that client receives - typically a malicious/rogue DNS server or an on-path/DNS-spoofing position. Affected deployments are Helidon 4.0.0-4.5.5 and 27.0.0. Limiting factors: the vulnerable DNS-resolver component must actually be in use, the attacker needs the ability to shape DNS answers, and impact is capped at partial data integrity and partial denial of service (no confidentiality loss); applications not using this resolver are not affected. |
| Impact | This is a mid-severity issue (CVSS 3.1 6.5) that should be treated as a routine, scheduled-patch priority rather than an emergency. The Oracle-supplied vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) describes a network-reachable, unauthenticated, low-complexity flaw, but the impact is deliberately limited: no confidentiality loss, only partial integrity (I:L) and partial availability (A:L) effects - consistent with the 'Denial Of Service' tag and the description's 'partial denial of service' / 'unauthorized update, insert or delete access to SOME data' language. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no evidence of active or probable near-term exploitation. One caveat worth verifying: the attack is described as occurring 'via DNS' against a DNS-resolver component, which in practice often requires an on-path or malicious-DNS-server position; Oracle nonetheless rated AC:L, so defenders in environments with untrusted DNS paths should weigh this higher than the raw score suggests. Overall: a real but contained flaw, not a high-urgency, widely-weaponized threat based on available signals. |
| Exploit ScenarioDerived | An attacker who can influence the DNS responses seen by a Helidon WebClient configured with the round-robin DNS resolver (e.g. a malicious/compromised DNS server or on-path position) returns crafted records that corrupt the resolver's address handling, causing the client to misroute or drop requests (partial DoS) and to accept/modify some application-accessible data (partial integrity impact). No authentication or user interaction is required. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Attacker-influenced DNS responses can corrupt outbound traffic from Helidon's WebClient when the round-robin DNS resolver is in use, allowing a network-positioned attacker to perform limited unauthorized modification of data and cause partial denial of service in Helidon 4.0.0 through 4.5.5 and 27.0.0. The flaw is remotely reachable without credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base 6.5), but only for deployments that actually enable the helidon-webclient-dns-resolver-round-robin component and only where the attacker can shape the DNS answers that client receives, such as a rogue DNS server or an on-path/DNS-spoofing position. There is no confidentiality impact and no public exploit identified at time of analysis, so this should be treated as a routine, scheduled-patch priority rather than an emergency.
RemediationAI
Apply the Helidon fix published in Oracle's October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released patch for the 4.0.0-4.5.5 and 27.0.0 lines; confirm the exact patched build from that advisory rather than assuming a version number, since the input data does not specify one. Where immediate upgrading is not possible, remove the exposure by not registering helidon-webclient-dns-resolver-round-robin and instead using a resolver backed by a static, operator-controlled address list or a DNSSEC-validating resolver - the trade-off is loss of automatic DNS-based round-robin load distribution, so failover must be handled by another mechanism. Additionally, restrict outbound DNS from Helidon hosts to vetted internal resolvers and block direct UDP/TCP 53 to the internet, which removes the rogue-DNS-server and spoofing preconditions at the cost of requiring all name resolution to flow through infrastructure you control; monitor for anomalous address changes in resolved service endpoints as a detection layer while patching proceeds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's Java microservices framework shipped within Fusion Middleware, and the affected artifact, helidon-webclient-dns-resolver-round-robin, implements client-side load balancing by resolving a hostname into a rotating set of IP addresses that the WebClient then dials in turn. Because that resolver consumes DNS answers as authoritative address input, an attacker who can return forged or manipulated A/AAAA records (via a malicious recursive resolver, cache poisoning, or an on-path spoofing position) can steer the client toward attacker-chosen endpoints, producing the assessed low integrity and low availability effects while leaving confidentiality untouched. The scoring reflects a trusted-boundary weakness in how resolver output is accepted rather than a remotely reachable code-execution path: scope is unchanged, no privileges or interaction are required, and exposure exists only on the code path where the round-robin resolver is actually wired into the WebClient. No CWE was supplied by the reporter, so the root cause should be read as insufficient validation/trust of DNS-supplied resolution data in the WebClient resolver pipeline.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-reachable, unauthenticated DNS-resolver flaw with no confidentiality impact and only partial integrity and availability effects; AC:L retained per vendor despite the DNS-positioning requirement.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-dns-resolver-round-robin). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB