CVE-2022-21404

Name of the Vulnerable Software and Affected Versions Helidon versions 1.4.10 and 2.0.0-RC1

Description The issue exists due to insufficient input validation in the Reactive WebServer component of Helidon, allowing an unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks can result in the takeover of Helidon. The vulnerability is difficult to exploit and can be leveraged by an attacker to execute arbitrary code using HTTP requests.

Recommendations For version 1.4.10, update to a version that includes the fix for this issue. For version 2.0.0-RC1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Reactive WebServer component until a patch is available.