The vulnerability is a resource exhaustion flaw in the Helidon web server’s HTTP/2 handling code (component: helidon-webserver-http2). An unauthenticated attacker with network access can send crafted HTTP/2 traffic that forces Helidon to allocate excessive resources, leading to a scheduler stall that partially denies service. The flaw is classified as CWE-400 (Resource Exhaustion). The CVSS assessment (3.1, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates a low severity impact limited to availability.

Oracle Helidon versions 4.0.0-4.5.5, including the helidon-webserver-http2 component, are affected. Any deployment that exposes an HTTP/2 endpoint using these releases is at risk. The issue does not affect earlier or later releases.

The CVSS base score of 3.7 classifies the flaw as low severity. The EPSS score is less than 1 %, signaling a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires direct network reachability to an HTTP/2‑enabled server and is considered difficult to achieve. Only availability is impacted, so overall risk remains low but should be monitored for publicly exposed services to prevent service degradation.