{"id":"CVE-2026-101584","kind":"vulnerability","aliases":["CVE-2026-101584"],"related":[],"title":"Helidon WebSocket client flaw lets unauthenticated attackers read data and cause partial denial of service","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-websocket).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).","summary":"The helidon-webclient-websocket component of Oracle's Helidon framework has a flaw reachable over HTTP without credentials. A remote attacker can read a subset of data Helidon can access and partially disrupt the service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helidon","java","oracle-fusion-middleware","package"],"not_affected_if":["no-websocket-client","other-helidon-version"],"how_to_check":"- Check the Helidon version in the project's build file (for example the `io.helidon` dependency version in `pom.xml` or `build.gradle`) and see whether it falls in `4.0.0` through `4.5.5` or `27.0.0`.\n- Confirm whether the application uses the `helidon-webclient-websocket` artifact.","fix":"- Move Helidon past the affected range to a fixed release listed in Oracle's advisory (the sources do not name the exact fixed version).","status":"open","published_at":"2026-10-20T22:18:11+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:55:13+00:00","updated_at":"2026-10-25T03:55:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:55:13Z","model":"claude-haiku-5-5","output":{"fix":"- Move Helidon past the affected range to a fixed release listed in Oracle's advisory (the sources do not name the exact fixed version).","reach":"internet","title":"Helidon WebSocket client flaw lets unauthenticated attackers read data and cause partial denial of service","impact":"medium","summary":"The helidon-webclient-websocket component of Oracle's Helidon framework has a flaw reachable over HTTP without credentials. A remote attacker can read a subset of data Helidon can access and partially disrupt the service.","category":"package","nicknames":[],"who_cares":["helidon","java","oracle-fusion-middleware"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads a subset of accessible data and partially disrupts service.","analyst_note":"Find Oracle's Critical Patch Update advisory for the fixed Helidon version and confirm whether the WebSocket client is reachable from inbound requests.","how_to_check":"- Check the Helidon version in the project's build file (for example the `io.helidon` dependency version in `pom.xml` or `build.gradle`) and see whether it falls in `4.0.0` through `4.5.5` or `27.0.0`.\n- Confirm whether the application uses the `helidon-webclient-websocket` artifact.","needs_analyst":true,"not_affected_if":["other-helidon-version","no-websocket-client"],"who_is_affected":"Applications built on Helidon 4.0.0 through 4.5.5 or 27.0.0 that include the helidon-webclient-websocket component. Teams on other Helidon versions or without the WebSocket client module can skip it. The sources do not describe further configuration conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000658,"input_tokens":3491,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101584':18A,21A '-2026':17A,20A '/av':148C '27.0.0':88C '3.1':136C,147C '4.0.0':85C '4.5.5':86C '6.5':139C 'abil':123C 'access':59B,97C,113C,119C 'affect':83C 'allow':92C 'attack':7A,50B,94C,104C 'avail':142C 'base':137C 'caus':11A,125C 'client':3A 'compon':34B,74C 'compromis':101C 'confidenti':140C 'credenti':47B 'cve':16A,19A 'cvss':135C,144C,146C 'data':9A,56B,120C 'denial':13A,128C 'disrupt':62B 'dos':132C 'easili':89C 'exploit':90C 'flaw':4A,42B 'framework':39B 'fusion':26B,72C 'helidon':1A,22B,31B,38B,57B,68C,76C,102C,118C,134C 'helidon-webclient-websocket':30B,75C 'http':45B,99C 'impact':143C 'java':23B 'l':156C 'l/i':154C 'l/pr':150C 'let':5A 'middlewar':27B,73C 'n/a':155C 'n/ac':149C 'n/s':152C 'n/ui':151C 'network':96C 'oracl':25B,36B,71C 'oracle-fusion-middlewar':24B 'packag':28B 'partial':12A,61B,127C,131C 'product':69C 'reachabl':43B 'read':8A,52B,112C 'remot':49B 'result':109C 'score':138C 'servic':15A,64B,130C 'subset':54B,116C 'success':103C 'support':79C 'u/c':153C 'unauthent':6A,93C 'unauthor':111C,122C 'vector':145C 'version':80C 'via':98C 'vulner':65C,91C,107C 'webclient':32B,77C 'websocket':2A,33B,78C 'without':46B","nicknames":[],"mitigations":[],"who_affected":"Applications built on Helidon 4.0.0 through 4.5.5 or 27.0.0 that include the helidon-webclient-websocket component. Teams on other Helidon versions or without the WebSocket client module can skip it. The sources do not describe further configuration conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101584","severity":null,"published_at":"2026-10-20T22:18:11+00:00","modified_at":"2026-10-21T18:39:21+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}