Helidon, a component of Oracle Fusion Middleware, contains a flaw in the helidon‑common‑concurrency‑limits module that permits an unauthenticated attacker with network access over HTTP to execute unauthorized updates, inserts, or deletes on data exposed by Helidon. The exploit can also trigger a partial denial of service, affecting the availability of Helidon services. The ability to modify data and degrade service availability corresponds to integrity and availability impacts as reflected in the CVSS vector.

Oracle’s Helidon product versions from 4.0.0 through 4.5.5 and version 27.0.0 are affected. The vulnerability is tied specifically to the helidon‑common‑concurrency‑limits component of these releases.

The CVSS base score is 6.5, indicating a medium severity threat that does not require authentication, has low complexity, and can be attacked remotely. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, which suggests it is not currently known to be exploited in the wild, but the vulnerability remains exploitable over the network. Attackers with network access can leverage the exposed HTTP interface to achieve the described impact without any special privileges.