EUVD-2026-79757
GHSA-854f-g5gq-5x2g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Unauthenticated HTTP-reachable JSON parser flaw with low complexity and only partial availability impact, so AV:N/AC:L/PR:N/UI:N with A:L and no C/I.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: JSON). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
AnalysisAI
Unauthenticated attackers with network access to an HTTP endpoint on Oracle Helidon 4.0.0 through 4.5.4 can trigger a partial denial of service in the framework's JSON component, degrading availability of the hosted application. The flaw is rated CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is described by Oracle as easily exploitable, though no public proof-of-concept, EPSS score, or CISA KEV entry was supplied in the input data, so active exploitation is unconfirmed.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond reachability - this is remote, unauthenticated exploitation (CVSS PR:N/UI:N/AC:L) against default configurations of Oracle Helidon 4.0.0-4.5.4, but it requires that the deployment actually exposes at least one HTTP endpoint whose request handling invokes the affected JSON component (any Helidon SE or MP route that parses a JSON request body). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) describes a low-complexity, unauthenticated, remotely reachable availability weakness with no confidentiality or integrity impact and no scope change - a classic nuisance-to-moderate DoS rather than a compromise vector, and the 5.3 base score is consistent with that. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Helidon update referenced in Oracle's security alert at https://www.oracle.com/security-alerts/cspusep2026.html - the supplied data does not state an exact patched version number, so verify the fixed release (anything above 4.5.4 per the affected range 4.0.0-4.5.4) against the advisory or Oracle's Helidon release notes before declaring remediation complete; treat this as 'Patch available per vendor advisory' rather than a confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today