A flaw in the Helidon webclient component allows an unauthenticated attacker that can reach the service over HTTP to read portions of data that should be protected. The vulnerability carries a CVSS 3.1 Base Score of 5.3 with a Confidentiality impact, meaning only information that is supposed to remain confidential may be exposed, while integrity and availability remain unaffected.

Oracle Helidon is impacted. The affected product versions are 4.0.0 through 4.5.5 and the early 27.0.0 release. Any deployment of these Helidon releases that exposes the webclient over the network is susceptible.

The vulnerability is considered easily exploitable, and the only requirement for an attacker is network access to the Helidon HTTP interface. Although the EPSS score is not available and the vulnerability is not yet listed in CISA's KEV catalog, the ease of exploitation combined with a moderate confidentiality impact warrants prompt attention. Attacks would result in the unauthorized reading of a subset of data accessible through Helidon, potentially revealing sensitive information.