Oracle Helidon EUVD-2026-62131

The target must be running Oracle Helidon version 4.5.0 using the Imperative Web Server component, accessible over HTTP/2. No authentication is required (PR:N per CVSS vector), and no user interaction is needed. The attack vector is network-based with low complexity. Exploitation is limited to confidentiality - no integrity or availability impact is confirmed. Deployments not using the Imperative Web Server component (e.g., using Helidon's reactive server only) may not be affected, though this distinction is not confirmed in available data. There are no confirmed non-default configuration requirements beyond running the affected component on the affected version.

The CVSS 3.1 score of 7.5 reflects a network-exploitable, low-complexity, no-authentication-required vulnerability with high confidentiality impact - a meaningful threat profile for any internet-facing Helidon service. The attack vector (AV:N), attack complexity (AC:L), and no privileges required (PR:N) indicate this is straightforward to exploit by any network-capable attacker. The scope is unchanged (S:U), meaning the impact is confined to the Helidon instance itself. No EPSS data was provided, so exploitation probability cannot be quantified independently. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified, reducing immediate real-world risk. However, the combination of no authentication requirement and easy exploitability warrants prompt patching for any externally accessible Helidon 4.5.0 deployment. The confidentiality-only impact (I:N/A:N) limits blast radius compared to a full RCE, but complete data exfiltration from a microservice can still be catastrophic depending on what data the service handles.

An unauthenticated attacker with HTTP/2 network access to a Helidon 4.5.0 Imperative Web Server sends a specially crafted HTTP/2 request that bypasses the application's authentication controls. The attacker then reads sensitive application data - potentially including API responses, configuration data, or business records - without presenting any credentials. No public proof-of-concept code has been identified at time of analysis.