The vulnerability affects Oracle Helidon 4.5.0, specifically in the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP/2 to cause a hang or repeated crash of Helidon, resulting in a complete denial of service. Additionally, the attacker can gain unauthorized read access to a subset of data accessible by Helidon. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact. Oracle's August 2026 Critical Security Patch Update advisory lists this vulnerability among many others but does not explicitly confirm patch availability or remediation steps for Helidon 4.5.0. Customers are strongly advised to remain on supported versions and apply security patches promptly.

Successful exploitation can lead to unauthorized read access to some Helidon data and cause a denial of service by hanging or crashing the Helidon server. This impacts confidentiality and availability of the affected system. The vulnerability requires no authentication and can be exploited remotely over the network via HTTP/2.

Oracle's advisory strongly recommends applying security patches without delay and remaining on actively supported versions. However, the specific patch or fix for Helidon 4.5.0 is not explicitly confirmed in the advisory content provided. Customers should monitor Oracle's official security alerts and apply any available patches for Helidon 4.5.0 as soon as they are released. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.