This vulnerability affects Oracle Helidon 4.5.0, specifically its Imperative Web Server component. An unauthenticated attacker with network access via HTTP can exploit this flaw to read a subset of accessible data without authorization and cause a partial denial of service condition. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and impacts confidentiality and availability. The vendor advisory lists Helidon 4.5.0 among affected versions but does not explicitly confirm a patch or fix for this vulnerability. Oracle's August 2026 Critical Security Patch Update advisory urges customers to apply patches promptly but does not provide a direct patch link or remediation details for this specific issue.

Successful exploitation results in unauthorized read access to some Helidon data and partial denial of service, impacting confidentiality and availability. There is no indication of integrity impact. The vulnerability is exploitable remotely without authentication, increasing risk.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Until a patch is confirmed, monitor vendor communications for updates.