This vulnerability affects the Helidon component of Oracle Fusion Middleware, specifically the Imperative Web Server. An attacker without authentication can exploit this flaw over HTTP/2 to cause Helidon to hang or crash repeatedly, resulting in a complete denial of service. Additionally, the attacker can read a subset of data accessible by Helidon without authorization. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation can lead to a complete denial of service of Helidon due to hangs or crashes and unauthorized disclosure of some Helidon-accessible data. This compromises availability and confidentiality but does not affect integrity.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. No indication from the vendor advisory suggests that no action is required or that the issue is already mitigated without patching.