Helidon 3

Apply the Java 17 prompt first. These rules cover Helidon 3 reactive SE and MicroProfile on Java 17 or newer and were checked against 3.2.20. Keep Helidon 3 APIs separate from Helidon 4's virtual-thread WebServer. The guidance includes known 3.2.20 limitations that require upgrading affected deployments.

Version and deployment boundary

• Treat 3.2.20 as affected: Oracle's September 2026 security advisory covers its IDCS role mapper, MongoDB DB Client, Neo4j integration, and multipart parser. Upgrade affected deployments to vendor-fixed components; 3.2.21 documents IDCS subject-type, MongoDB numeric-parameter, and multipart parsing fixes. Verify Neo4j remediation separately rather than inferring it from those fixes.
• Import the Helidon BOM or dependencies POM and keep Helidon modules on one deliberately selected patch. Audit the resolved dependency graph and overrides; the Netty, Jackson, PostgreSQL, and other versions managed by 3.2.20 are not a guarantee of current security.
• Run on a patched supported Java 17-or-newer runtime and verify the chosen JDK, native-image build, TLS provider, and framework integrations together. Preserve the Java 17 baseline's dependency and artifact controls for Helidon providers, media readers, CDI extensions, and configuration parsers.

Reactive routing and request limits

• Register exact method and path routes in Routing; place authentication, authorization, and limits before handlers that can consume or complete a request. Call req.next() only after checks succeed, and use req.next(throwable) or a completed denial response