EUVD-2026-105994
GHSA-cqc3-x785-wp5c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Helidon webclient over HTTP
-
ExploitSend crafted HTTP request
-
ImpactRead unauthorized subset of data
Vulnerability Assessment
| Exploitation Conditions | Exploitation targets the helidon-webclient component of applications built on Helidon versions 4.0.0-4.5.5 or 27.0.0 and requires only network HTTP reachability to that component; per CVSS PR:N/UI:N it needs no authentication and no user interaction against default configurations. The practical limit is impact scope, not access: successful attacks yield only unauthorized read access to a subset of Helidon-accessible data (C:L), with no write/modification or denial-of-service capability, so the realistic risk is information leakage rather than takeover. The description names no required non-default setting or feature toggle, so no special configuration precondition could be confirmed. |
| Impact | Signals point to a moderate, not critical, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a network-reachable, low-complexity, unauthenticated flaw, but impact is confined to low confidentiality - unauthorized read of a subset of Helidon-accessible data - with no integrity or availability effect and no scope change. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit was referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The one notable conflict is in the metadata rather than the scoring: the input Tag 'Authentication Bypass' does not match the described behavior, which is an information-disclosure/read-access issue, not a bypass of authentication - treat that tag as suspect. Net: a genuine but medium-severity information-leak bug meriting routine patching in the Oracle October 2026 CPU cycle, not emergency response, absent any exploitation evidence. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted HTTP traffic to a service built on the affected Helidon webclient and receives back a subset of data they should not be able to read. No public proof-of-concept was identified, and the leak is limited to confidentiality of a data subset rather than full compromise. Low attack complexity (AC:L) means no special timing or race conditions are required once the vulnerable component is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
An information-disclosure flaw in the helidon-webclient component of Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 lets remote attackers read a limited subset of Helidon-accessible data over HTTP without authenticating or interacting with a user. The impact is confined to confidentiality (CVSS 3.1 base score 5.3, C:L with no integrity or availability effect), so the realistic risk is leakage of application data rather than takeover or service disruption. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV data was not provided.
RemediationAI
Upgrade to a Helidon release outside the affected ranges as specified in the October 2026 Oracle Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); Oracle CPU advisories typically direct customers to the patched version listed for each affected product line, and that advisory should be treated as authoritative because the input data provides no independent confirmed fix version number. Note that per Oracle's standard CPU policy the October 2026 advisory is the reference point for the corrected Helidon 4.x and 27.x artifacts. Where immediate upgrade is not feasible, compensating controls should focus on limiting reachability of the helidon-webclient component: restrict inbound network paths to the component with firewall or security-group rules so only trusted service consumers can reach it (trade-off: breaks legitimate cross-service client traffic that is not proxied), and front it with an authenticating reverse proxy or mTLS gateway (trade-off: requires certificate/config rollout and may break non-browser or legacy clients). Because the flaw yields read-only exposure of a limited data subset, also review what sensitive data the webclient can reach and reduce that exposure until patching is complete. Monitor for public exploit code, as none was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's set of Java libraries for building microservices, and the helidon-webclient module provides the reactive HTTP client used by applications to make outbound and internal web calls. The vulnerability arises in how that webclient component handles HTTP requests, allowing an unauthenticated network-positioned attacker to obtain read access to a subset of data reachable through Helidon. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms the weakness is trivially reachable (low attack complexity, no privileges, no user interaction) but strictly limits the outcome to partial confidentiality loss within the same security scope - there is no path to code execution, data modification, or denial of service described. No CWE was assigned in the source data, and the description identifies no mandatory non-default configuration or feature toggle, so any application exposing the vulnerable webclient functionality should be assumed reachable.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated HTTP reach with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is read access to a data subset, so C:L and I:N/A:N.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB