The Helidon webclient DNS resolver component contains a flaw that lets an unauthenticated attacker who can reach the Helidon server over DNS perform unauthorized updates, inserts, or deletions of data managed by Helidon, and can also induce a partial denial of service. The vulnerability is a medium severity (CVSS 3.1 Base Score 6.5) short‑form vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating that integrity and availability are the affected security objectives.

Oracle Helidon is affected. All releases from 4.0.0 through 4.5.5 and the 27.0.0 release contain the flaw.

The CVSS score indicates a moderate risk, and because the EPSS score is not available the probability of real‑world exploitation is unclear but not negligible. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path is a remote attacker sending crafted DNS traffic to the Helidon instance; no authentication or special credentials are required. Successful exploitation can compromise confidentiality of Helidon‑managed data and degrade service availability.