Helidon, an Oracle Fusion Middleware component, contains a vulnerability (CWE‑400) in the helidon-common-mapper module that allows an unauthenticated attacker to create, delete or modify critical data, read unused data, and cause a partial denial of service. The flaw operates over HTTP and is considered difficult to exploit due to required network access and the need to target the vulnerable endpoint. The CVSS 3.1 score of 7.0 reflects medium to high impact on confidentiality, integrity, and availability.

Oracle Helidon products, specifically versions 4.0.0 through 4.5.5 and version 27.0.0, are affected. This vulnerability is a CWE‑400 resource exhaustion flaw, meaning an unauthenticated network attacker could exploit the Helidon service when exposed to HTTP traffic. Any deployment of these releases that exposes Helidon services to network traffic is vulnerable.

This vulnerability is accessed over the network via HTTP, implying a remote attack vector. It is a CWE‑400 resource exhaustion vulnerability, so an attacker may consume system resources and disrupt services. While the exploit is described as difficult, the moderate‑to‑high CVSS score of 7.0 indicates significant potential impact on confidentiality, integrity, and availability. The EPSS score of < 1% suggests a low likelihood of active exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread attacks. Nevertheless, the ability for an unauthenticated attacker to create, delete, or modify critical data and to cause partial denial of service warrants prompt mitigation.