Helidon
Monthly
Helidon 3.2.18's Imperative Web Server component exposes an unauthenticated, network-accessible denial-of-service condition via HTTP that allows remote attackers to partially degrade service availability without any credentials or user interaction. Only the Availability dimension is affected - Confidentiality and Integrity remain intact - classifying this as a medium-severity partial DoS. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower operational priority tier despite its trivial exploitation conditions.
Unauthorized data read in Oracle Helidon 4.5.0's Imperative Web Server component exposes a subset of server-accessible data to unauthenticated remote attackers over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable without credentials, and the 'Authentication Bypass' tag from intelligence sources suggests access controls within the Imperative Web Server are being circumvented rather than simply an information leak. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated remote data modification is possible in Oracle Helidon 3.2.19 via its Imperative Web Server component, exploitable over HTTP with no credentials or user interaction required. Successful exploitation allows an attacker to perform unauthorized insert, update, or delete operations on data accessible to the Helidon instance, with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Local exploitation of Oracle Helidon 4.5.0's Imperative Web Server component enables a low-privileged attacker with infrastructure logon to bypass authentication controls and gain unauthorized access to all data accessible by the Helidon process, with limited write capability. Confirmed by Oracle's Critical Patch Update for August 2026 and corroborated by EUVD-2026-62096, this carries a CVSS 3.1 score of 6.1. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server allows unauthenticated network attackers to bypass authentication over HTTP and gain complete read access to critical data, including data accessible across additional connected products due to a confirmed scope change. The vulnerability is rated CVSS 6.8 with high attack complexity, meaning exploitation requires specific conditions to be met, which limits opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and scope-change impact make this a material risk for Oracle Fusion Middleware deployments running the affected version.
Unauthorized read and write access to Helidon-accessible data is possible through the Imperative Web Server component in Oracle Helidon 3.2.19 via a network-deliverable HTTP attack that requires victim interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with scope change is characteristic of a client-side injection vulnerability such as Cross-Site Scripting or CSRF, where the attack crosses a scope boundary to impact resources or systems beyond the Helidon process itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV at time of analysis; Oracle disclosed it via the August 2026 Critical Patch Update.
Unauthorized read access to a subset of data is possible in Oracle Helidon 3.2.18's Imperative Web Server component via unauthenticated HTTPS network requests. Tagged as an Authentication Bypass, this flaw allows a remote unauthenticated attacker with network reach to the affected service to circumvent access controls and retrieve restricted information without any credentials or user interaction. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and zero-privilege requirement make it accessible to unsophisticated attackers.
Integrity-bypassing authentication flaw in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to create, delete, or modify critical application data via HTTP, despite requiring high attack complexity to trigger. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the attack is network-reachable without credentials but is gated behind difficult-to-replicate exploitation conditions. No active exploitation has been confirmed (no CISA KEV listing), and no public exploit code has been identified at time of analysis.
Unauthorized read access in Oracle Helidon 3.2.20's Imperative Web Server component allows unauthenticated network attackers to bypass authentication controls via HTTP and retrieve a limited subset of application data. The vulnerability is tagged as an Authentication Bypass and is difficult to exploit due to high attack complexity (AC:H), materially reducing real-world risk despite the network-accessible attack vector. No active exploitation is confirmed and no public exploit code has been identified at time of analysis. The CVSS score of 3.7 accurately reflects the low-severity nature: limited data exposure with no integrity or availability impact.
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Reactive WebServer). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
Helidon 3.2.18's Imperative Web Server component exposes an unauthenticated, network-accessible denial-of-service condition via HTTP that allows remote attackers to partially degrade service availability without any credentials or user interaction. Only the Availability dimension is affected - Confidentiality and Integrity remain intact - classifying this as a medium-severity partial DoS. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower operational priority tier despite its trivial exploitation conditions.
Unauthorized data read in Oracle Helidon 4.5.0's Imperative Web Server component exposes a subset of server-accessible data to unauthenticated remote attackers over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable without credentials, and the 'Authentication Bypass' tag from intelligence sources suggests access controls within the Imperative Web Server are being circumvented rather than simply an information leak. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated remote data modification is possible in Oracle Helidon 3.2.19 via its Imperative Web Server component, exploitable over HTTP with no credentials or user interaction required. Successful exploitation allows an attacker to perform unauthorized insert, update, or delete operations on data accessible to the Helidon instance, with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Local exploitation of Oracle Helidon 4.5.0's Imperative Web Server component enables a low-privileged attacker with infrastructure logon to bypass authentication controls and gain unauthorized access to all data accessible by the Helidon process, with limited write capability. Confirmed by Oracle's Critical Patch Update for August 2026 and corroborated by EUVD-2026-62096, this carries a CVSS 3.1 score of 6.1. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server allows unauthenticated network attackers to bypass authentication over HTTP and gain complete read access to critical data, including data accessible across additional connected products due to a confirmed scope change. The vulnerability is rated CVSS 6.8 with high attack complexity, meaning exploitation requires specific conditions to be met, which limits opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and scope-change impact make this a material risk for Oracle Fusion Middleware deployments running the affected version.
Unauthorized read and write access to Helidon-accessible data is possible through the Imperative Web Server component in Oracle Helidon 3.2.19 via a network-deliverable HTTP attack that requires victim interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with scope change is characteristic of a client-side injection vulnerability such as Cross-Site Scripting or CSRF, where the attack crosses a scope boundary to impact resources or systems beyond the Helidon process itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV at time of analysis; Oracle disclosed it via the August 2026 Critical Patch Update.
Unauthorized read access to a subset of data is possible in Oracle Helidon 3.2.18's Imperative Web Server component via unauthenticated HTTPS network requests. Tagged as an Authentication Bypass, this flaw allows a remote unauthenticated attacker with network reach to the affected service to circumvent access controls and retrieve restricted information without any credentials or user interaction. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and zero-privilege requirement make it accessible to unsophisticated attackers.
Integrity-bypassing authentication flaw in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to create, delete, or modify critical application data via HTTP, despite requiring high attack complexity to trigger. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the attack is network-reachable without credentials but is gated behind difficult-to-replicate exploitation conditions. No active exploitation has been confirmed (no CISA KEV listing), and no public exploit code has been identified at time of analysis.
Unauthorized read access in Oracle Helidon 3.2.20's Imperative Web Server component allows unauthenticated network attackers to bypass authentication controls via HTTP and retrieve a limited subset of application data. The vulnerability is tagged as an Authentication Bypass and is difficult to exploit due to high attack complexity (AC:H), materially reducing real-world risk despite the network-accessible attack vector. No active exploitation is confirmed and no public exploit code has been identified at time of analysis. The CVSS score of 3.7 accurately reflects the low-severity nature: limited data exposure with no integrity or availability impact.
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Reactive WebServer). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.