CVE-2026-101584: Medium severity Oracle Helidon vulnerability
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-websocket). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker with network access to the affected Helidon service over HTTP can exploit it. No user interaction or prior privileges are required.
Which deployments are affected?
The affected component is helidon-webclient-websocket in Oracle Helidon. Supported affected versions are 4.0.0 through 4.5.5 and 27.0.0.
What is the potential impact?
Successful exploitation can allow unauthorized reading of a subset of Helidon-accessible data and can cause a partial denial of service. The vulnerability does not have an integrity impact in the supplied CVSS assessment.