Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
Published: 2026-08-18
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle Helidon’s Imperative Web Server permits an unauthenticated attacker with network access via HTTP to read a limited set of data that should be protected and trigger a partial denial of service. The weakness is an instance of Incorrect Access Control (CWE-284), exposing sensitive information and interrupting service availability.

Affected Systems

The affected product is Oracle Helidon from Oracle Corporation. Vulnerable releases include Helidon 4.0.0 through 4.4.1; Helidon 4.5.0 is not listed as vulnerable in the current description. No other components are identified as affected.

Risk and Exploitability

The CVSS v3.1 base score of 6.5 reflects moderate impact on confidentiality and availability. The EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is network-based via HTTP and requires no authentication; the attacker can simply send crafted HTTP requests to the Helidon service to read protected data and cause a partial denial of service.

Generated by OpenCVE AI on August 28, 2026 at 23:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to a newer Helidon version that includes the fix.
  • Restrict Helidon’s HTTP endpoints to trusted hosts using firewall rules to limit network exposure.
  • Monitor Helidon logs for suspicious read or denial‑of‑service activity to detect exploitation attempts.

Generated by OpenCVE AI on August 28, 2026 at 23:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Helidon 4.5.0 Unauthorized Data Disclosure and Partial Denial of Service via HTTP

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Title Helidon 4.5.0 Unauthorized Data Disclosure and Partial Denial of Service via HTTP

Thu, 20 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Disclosure and Partial Denial of Service Vulnerability in Oracle Helidon 4.5.0

Wed, 19 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Disclosure and Partial Denial of Service Vulnerability in Oracle Helidon 4.5.0

Wed, 19 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Data Disclosure and Partial Denial in Oracle Helidon 4.5.0
Weaknesses CWE-200
CWE-285
CWE-399

Wed, 19 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Data Disclosure and Partial Denial in Oracle Helidon 4.5.0
Weaknesses CWE-200
CWE-285
CWE-399

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T17:59:14.181Z

Reserved: 2026-08-13T18:41:45.888Z

Link: CVE-2026-73914

cve-icon Vulnrichment

Updated: 2026-08-19T12:08:12.265Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:24.250

Modified: 2026-08-28T20:19:50.783

Link: CVE-2026-73914

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T23:15:04Z

Weaknesses