Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Published: 2026-10-20
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: Partial Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the Helidon web server component that handles HTTP/2 requests. An external attacker who can send crafted HTTP/2 traffic without authentication can trigger a partial denial of service, reducing Helidon availability. The flaw is reflected in a CVSS 3.1 score of 3.7, indicating a low severity impact limited to availability.

Affected Systems

Oracle Helidon versions 4.0.0 through 4.5.5, specifically the helidon-webserver-http2 component, are affected. Systems exposing an HTTP/2 endpoint using these releases are at risk.

Risk and Exploitability

The CVSS score of 3.7 classifies the vulnerability as low severity. EPSS is unavailable, and the CVE is not listed in the CISA KEV catalog. The likely attack vector requires network access via HTTP/2 and is considered difficult to exploit. Only availability is impacted; therefore overall risk is low, but vigilance is advised for publicly exposed services.

Generated by OpenCVE AI on October 21, 2026 at 05:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Oracle Helidon to version 4.5.6 or later to remove the vulnerability.
  • If an upgrade is not possible, disable HTTP/2 support on the Helidon web server to prevent exploit attempts.
  • Monitor Helidon logs and resource usage for abnormal HTTP/2 traffic and consider rate limiting or connection throttling.

Generated by OpenCVE AI on October 21, 2026 at 05:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Title Helidon Web Server HTTP/2 Vulnerability Allows Partial Denial of Service
Weaknesses CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:36.913Z

Reserved: 2026-09-28T15:40:09.492Z

Link: CVE-2026-101570

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:10.187

Modified: 2026-10-20T22:18:10.187

Link: CVE-2026-101570

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T05:15:07Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling