A vulnerability exists in the WebSocket component of Oracle Helidon that permits an unauthenticated attacker with network connectivity to read a subset of data that the Helidon instance exposes. The flaw enables confidential information disclosure without requiring any credentials or user interaction, leveraging a simple network request over HTTP. The weakness is identifiable as a data exposure flaw that can compromise the confidentiality of sensitive information.

Oracle Helidon versions from 4.0.0 through 4.5.5, and the 27.0.0 release, are affected by this vulnerability. Users deploying any of these product releases should verify whether they are running the impacted builds.

With a CVSS 3.1 base score of 5.3, the vulnerability is considered moderate in severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, but the description indicates it is easily exploitable from an unauthenticated network attacker. The primary attack vector is network access via HTTP, requiring no authentication or privileged user interaction. Consequently, the risk to organizations that expose Helidon’s WebSocket endpoint to the network is that they may experience unauthorized data disclosure should the vulnerability be exploited.