This vulnerability affects Oracle Helidon 4.5.1, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to cause a hang or frequent crash, resulting in a complete denial of service. The CVSS 3.1 base score is 7.5, reflecting high impact on availability with no impact on confidentiality or integrity. The vulnerability is publicly disclosed and included in Oracle's August 2026 Critical Security Patch Update advisory, which covers many Oracle products and versions. However, the advisory does not explicitly confirm the availability of a patch for this specific version, only that patches are provided for affected products including Helidon.

Successful exploitation results in denial of service by causing the Helidon server to hang or crash repeatedly. This impacts availability but does not compromise confidentiality or integrity. The vulnerability can be exploited remotely without authentication via HTTP network access.

Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among many others and recommends applying available security patches promptly. Since the advisory lists Helidon 4.5.1 as affected, users should check the Oracle advisory for the latest patch availability and apply the relevant patches without delay. Patch status is not explicitly confirmed in the advisory content provided; therefore, users must verify patch availability and installation instructions from the official Oracle advisory. No vendor statement indicates that no action is required or that the issue is already mitigated.