EUVD-2026-62126
GHSA-62hf-3432-5r3m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Helidon 3.2.19 HTTP endpoint
-
DeliverySend crafted HTTP request to Imperative Web Server
-
ExploitTrigger internal hang or crash condition
-
ExecutionService becomes unresponsive or terminates
-
ImpactRepeat to sustain denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network reachability to the Helidon HTTP port. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of Oracle Helidon 3.2.19 Imperative Web Server. The vulnerability is specific to the Imperative Web Server component - deployments using only the reactive API model may not be affected, but this has not been confirmed by Oracle in the available advisory. Exploitation is constrained to the single confirmed version 3.2.19; other versions in the 3.x line are not listed as affected. The impact is limited to availability - no privilege escalation, data access, or integrity modification is possible through this vulnerability. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a high-severity, easily exploitable network-based denial-of-service: no authentication, no complexity barrier, no user interaction required, with complete availability impact. The absence of EPSS data, KEV listing, and public POC means exploitation probability cannot be quantified numerically, but the structural signal from CVSS - a low-complexity, unauthenticated network attack - is sufficient that even a mid-sized municipal IT team in legnica running Helidon 3.2.19 in a microservices cluster should treat this as urgent given the complete-crash impact. The scope is limited to availability: confidentiality and integrity are unaffected, which reduces the blast radius compared to a code-execution flaw. However, for any service-availability-sensitive workload - APIs, middleware orchestration layers, or public-facing Helidon endpoints - this represents a real operational risk. No conflicting signals exist between the description and the CVSS vector; both consistently indicate an unauthenticated remote DoS with no preconditions. |
| Exploit ScenarioDerived | An attacker with network access to a Helidon 3.2.19 HTTP endpoint sends a crafted HTTP request - or a sequence of requests - that triggers a hang or crash within the Imperative Web Server's request-handling path, causing the service to become unresponsive or terminate. The attack requires no credentials or prior access, and given the AC:L rating, is likely repeatable and automatable, potentially enabling sustained denial of service. No public proof-of-concept code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Denial-of-service in Oracle Helidon 3.2.19's Imperative Web Server component allows remote unauthenticated attackers to cause a complete hang or repeatable crash via HTTP, fully disrupting service availability. The vulnerability requires no authentication, no user interaction, and no special configuration, making it trivially exploitable against any network-accessible Helidon 3.2.19 instance. No public exploit code has been identified and it does not appear in CISA KEV at time of analysis, though the low attack complexity elevates operational risk for any exposed deployment.
RemediationAI
Apply the fix documented in the Oracle Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. A specific patched version number was not disclosed in the available intelligence data; consult the CPU directly for the target upgrade version. As a compensating control where patching is not immediately possible, restrict network access to Helidon HTTP listener ports using firewall rules or API gateway policies to trusted source IP ranges only, reducing the attack surface to authenticated or known clients. Additionally, placing the Helidon service behind a reverse proxy or load balancer with HTTP request rate limiting and connection throttling can reduce the impact of repeated crash or hang attempts, though these controls do not eliminate the underlying vulnerability. Note that restricting access may affect legitimate clients and should be coordinated with application owners.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Helidon is an open-source Java microservices framework developed by Oracle, offered in two programming models: a reactive API (based on Java virtual threads and reactive streams) and an Imperative Web Server, which provides a traditional blocking servlet-style HTTP server interface. The affected component - the Imperative Web Server - is the synchronous request-handling layer in Helidon 3.x. The specific affected version is 3.2.19 under Oracle Fusion Middleware. No CWE identifier was assigned, so the precise root cause class (e.g., resource exhaustion, improper request parsing, thread starvation) is not disclosed by Oracle. The vulnerability is reachable over standard HTTP, consistent with the server's primary interface. CPE data was not provided in the intelligence feed, but the affected scope is narrowly defined as Helidon 3.2.19.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable HTTP service, no authentication or interaction required, impact is exclusively complete availability loss with no confidentiality or integrity effects.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Helidon 3.2.19's Imperative Web Server component is vulnerable to remote denial-of-service attacks that can completely hang or crash the server, disrupting service availability for any network-accessible deployment. With no vendor patch currently available and unauthenticated access required, this poses immediate risk to production applications relying on Helidon 3.2.19.
No vendor-released patch identified at time of analysis. Interim mitigations: network segmentation to limit Helidon instance exposure, HTTP rate-limiting and strict connection-timeout enforcement at load balancers or WAF, Web Application Firewall rules blocking malformed HTTP requests, continuous monitoring for service unavailability events, and documented incident response procedures for rapid failover or service restart.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB