The Helidon media multipart component in Oracle Fusion Middleware is vulnerable to an uncontrolled resource consumption flaw. An unauthenticated attacker who can reach the application over HTTP can send specially crafted multipart requests that trigger excessive resource usage and cause Helidon to stop responding, resulting in a partial denial of service. The weakness aligns with CWE-400 and does not expose confidentiality or integrity data.

Oracle Helidon, version 3.0.0 through 3.2.20.

The CVSS v3.1 base score of 5.3 indicates moderate severity with an availability impact. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation at present, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is primarily network-based with unauthenticated HTTP requests, and no privileged access or user interaction is required. Over time, the risk could increase if the flaw is discovered to be easier to exploit or if attackers target Helm processes in larger deployments.