The Helidon LRA component contains a weakness that allows an unauthenticated attacker with network access via HTTP to modify, insert, or delete Helidon data, read sensitive portions of that data, and induce a partial denial of service. The flaw involves resource exhaustion (CWE-400), resulting in loss of confidentiality, integrity, and availability for affected Helidon instances.

Oracle Helidon versions 4.0.0 through 4.5.5 are affected. The vulnerability may also impact other Oracle Fusion Middleware products that rely on Helidon, expanding the potential scope of compromise.

The vulnerability carries a CVSS 3.1 base score of 6.5, indicating medium severity. Its EPSS score of less than 1% suggests a low but non‑zero probability of exploitation, and it is not currently listed in CISA’s KEV catalog. Exploitation conditions are minimal: an unauthenticated attacker only needs HTTP connectivity to a vulnerable Helidon instance. If the service is exposed to the internet, the risk remains non‑negligible, with the potential for unauthorized data modification, leakage, and partial service disruption.