Threats affecting pkg:maven/io.helidon/helidon-websocket

CVE-2026-101588 is a medium severity vulnerability in Oracle Helidon WebSocket component affecting versions 4.0.0 through 4.5.5 and 27.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some Helidon accessible data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating limited confidentiality impact without integrity or availability effects. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches for affected versions.

A vulnerability in the WebSocket component of Oracle Fusion Middleware's Helidon product (versions 4.0.0 through 4.5.4) allows an unauthenticated attacker with network access via HTTP to cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on availability. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update.