Unauthenticated HTTP denial of service in Oracle Fusion Middleware Helidon

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

• Oracle Helidon: The helidon-webserver-static-content component is affected in versions 4.0.0 through 4.5.4, inclusive, according to the normalized affected facts and Oracle's CVE-specific advisory entry.
• The broader Oracle product update lists Helidon product versions 3.0.0-3.2.20 and 4.0.0-4.5.4, but the CVE-specific row supports only 4.0.0-4.5.4 for this entry. Do not expand this CVE's scope to the 3.x branch based only on the broader product list.
• The supplied evidence does not identify an exact fixed Helidon release.

Oracle identifies the affected component as helidon-webserver-static-content in Helidon, part of Oracle Fusion Middleware. The attack path is reachable over HTTP from the network and does not require authentication, user interaction, or stated privileges; the normalized record marks attack complexity as low. An attacker-controlled HTTP request can trigger a condition that hangs Helidon or causes frequently repeatable crashes, resulting in complete denial of service. The record does not disclose the triggering route, request form, static-content operation, or implementation detail, so no payload or endpoint should be inferred. The described technical effect is limited to availability, with no stated confidentiality or integrity impact.

• Reachability: A remote attacker can reach the service over the network through HTTP.
• Authentication and interaction: No authentication or user interaction is required.
• Complexity: Oracle characterizes the vulnerability as easily exploitable, and the normalized record marks attack complexity as low.
• Status: The supplied record leaves known_exploited unset and marks public_exploit as false. This is record status, not evidence that exploitation is impossible.

The supplied evidence does not provide a triggering request, public exploit, or specific exploitation indicators.

The confirmed technical outcome is a Helidon hang or frequently repeatable crash that can result in complete denial of service. Because exploitation requires no authentication, an HTTP endpoint reachable from an untrusted network could be used to interrupt service if the affected component is exposed.

Likely organisational consequences include loss of service, disruption to dependent applications, operational alerts, and recovery or restart costs. The record provides no evidence that the flaw enables data access, data modification, or privilege escalation. The triggering request, persistence after restart, and exact recovery behavior remain undisclosed.

The vulnerability can interrupt service availability for applications that depend on Helidon, especially when an instance hangs or requires repeated recovery. Repeated crashes may create operational recovery work, reduce service availability, and disrupt downstream services.

The record describes an availability impact and does not state that the flaw permits data disclosure, data modification, or privilege gain. Actual exposure depends on whether the deployment exposes the affected component through HTTP and how the service handles restart or recovery; those configuration-specific limits are not documented.

1. Apply the Oracle security patch associated with this issue in the September 2026 Critical Security Patch Update and follow the Helidon patch availability and installation documentation. The supplied evidence does not state an exact fixed Helidon release, so an unverified release must not be treated as a confirmed fix.
2. Inventory Helidon deployments, confirm whether helidon-webserver-static-content is present, and prioritize instances in 4.0.0 through 4.5.4 that are reachable over HTTP from untrusted networks.
3. Before patching, reduce exposure by restricting or blocking the network access paths required for the attack where operationally feasible. This is Oracle's general mitigation guidance, not a confirmed component-specific workaround.
4. If running a release outside support, move to a supported release. Oracle notes that earlier unsupported releases may also be affected, but the supplied evidence does not map those releases specifically to this CVE.

1. Inventory Oracle Helidon deployments and identify where helidon-webserver-static-content is present.
2. Check deployment metadata, dependency manifests, or build information to compare the Helidon version with the affected range in affected_summary.
3. Identify instances reachable through HTTP from external or otherwise untrusted networks, including paths through load balancers, reverse proxies, and gateways.
4. Review operational telemetry for Helidon hangs, repeated crashes, unexpected restarts, or service degradation correlated with inbound HTTP traffic. Treat these as precautionary symptoms, not as confirmed indicators of this vulnerability.
5. Do not treat the absence of crash logs as proof of safety. The record provides no confirmed log signature, request signature, or IOC.