This vulnerability affects Oracle Helidon 4.5.0, specifically the Imperative Web Server component. It can be exploited remotely without authentication over HTTP/2, allowing attackers to read a subset of accessible data without authorization and cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and limited availability impact. Oracle's advisory references this vulnerability among many others in their August 2026 Critical Security Patch Update but does not explicitly confirm a patch for this specific version. Customers are urged to apply available patches promptly to mitigate risks.

Successful exploitation can lead to unauthorized read access to some Helidon data and partial denial of service, impacting confidentiality and availability. The vulnerability does not affect integrity and does not require authentication or user interaction to exploit. The CVSS score of 6.5 reflects a medium severity level.

Oracle's advisory strongly recommends that customers remain on actively supported versions and apply security patches without delay. However, the vendor advisory does not explicitly confirm a patch or remediation level for Helidon 4.5.0 regarding this vulnerability. Therefore, patch status is not yet confirmed—check the Oracle advisory for current remediation guidance and apply any available updates promptly.