Oracle Helidon EUVD-2026-62179

Helidon 4.5.1 must be deployed using the Imperative Web Server component and accessible over HTTP from the attacker's network position. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no special configuration, non-default settings, authentication, or user interaction is required - exploitation is viable against any default-configured Helidon 4.5.1 instance reachable over HTTP. The primary limiting factors are: (1) the affected version is narrowly scoped to 4.5.1, so deployments on other versions are not confirmed vulnerable; (2) impact is restricted to availability - no confidentiality or integrity breach occurs; and (3) Helidon is a niche framework, limiting the overall population of exposed endpoints. Network segmentation that prevents untrusted access to the HTTP port is the sole confirmed deployment-level mitigating condition.

The CVSS 7.5 rating accurately reflects real-world exploitability: the AV:N/AC:L/PR:N/UI:N vector means any attacker with HTTP reachability can trigger the vulnerability with no authentication, no elevated complexity, and no required user interaction - conditions that translate directly to trivial, scriptable denial-of-service. No EPSS score was provided in the available data, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The scope is unchanged (S:U) and impact is limited strictly to availability (A:H), with confidentiality and integrity unaffected, which constrains the blast radius to service disruption rather than data compromise. That said, the zero-barrier exploitation path means that even a mid-sized municipal IT team in tczew running Helidon 4.5.1 microservices on internet-exposed infrastructure should treat patching as urgent regardless of the absence of a KEV listing. POC availability is unknown; the lack of a public exploit does not reduce the inherent exploitability given the low attack complexity.

An unauthenticated external attacker sends a specially crafted HTTP request to an internet-exposed Helidon 4.5.1 service. The Imperative Web Server component fails to handle the malformed or adversarial input, triggering a hang or crash of the Java process. The service becomes unavailable to all legitimate users, and the condition is repeatable, meaning the attacker can sustain the outage by retransmitting the trigger request after any automatic restart.