Helidon, an Oracle Fusion Middleware component, contains a vulnerability in its helidon-webclient-http2 module that permits an unauthenticated attacker with network access via HTTP/2 to trigger a repeatable crash or hang, thereby causing a complete denial of service. The flaw does not affect confidentiality or integrity; it solely impacts availability as reflected by the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No mention of resource depletion or code execution is present in the official description.

Oracle Helidon products, versions 4.0.0 through 4.5.5 and 27.0.0, are affected. Any deployment that exposes an HTTP/2 endpoint over the network falls within scope.

The CVSS base score of 7.5 indicates a high‑severity availability flaw. An unauthenticated network attacker can exploit it via crafted HTTP/2 traffic, leading to application hang or crash. The EPSS score of < 1% and the fact that it is not listed in the CISA KEV catalog do not diminish the need for mitigation. Environments with publicly exposed Helidon instances must assume the risk of service disruption.