This vulnerability affects Oracle Helidon 3.2.20, specifically in the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to cause a hang or repeated crash of the Helidon server, resulting in a complete denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no impact on confidentiality or integrity, and high impact on availability. The vendor advisory lists this vulnerability among many addressed in the August 2026 Critical Security Patch Update but does not explicitly confirm patch availability or remediation details for this specific version.

Successful exploitation results in a denial of service condition by causing the Helidon server to hang or crash repeatedly. This disrupts service availability but does not compromise data confidentiality or integrity. The vulnerability is exploitable remotely without authentication, increasing its risk.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions to mitigate this and other vulnerabilities. Until a patch is applied, consider limiting network exposure of affected Helidon instances to reduce risk.