Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Partial Denial of Service
Action: Monitor
AI Analysis

Impact

A flaw in Helidon’s helidon-webclient-http1 component permits an unauthenticated attacker with network access via HTTP to trigger a partial denial of service. The CVE description specifies an availability impact and the base CVSS score of 5.3, indicating moderate severity for this weakness, which falls under CWE‑400.

Affected Systems

Affected systems are Oracle Helidon versions 4.0.0 through 4.5.5 and 27.0.0. The CVE notes that no vendor patch is currently mentioned for these releases.

Risk and Exploitability

The vulnerability can be exploited over the network via HTTP and does not require authentication. The CVSS score of 5.3 reflects a moderate availability impact and a low effort to exploit. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 21, 2026 at 04:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle Helidon release notes or vendor site for any available update or patch that addresses this vulnerability.
  • Restrict HTTP access to Helidon services by limiting traffic to trusted networks or using firewall rules to block unsolicited requests.
  • Monitor Helidon logs and network traffic for abnormal patterns or repeated failed request attempts that could signify exploitation attempts.

Generated by OpenCVE AI on October 21, 2026 at 04:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
Title Partial Denial of Service via Unauthenticated HTTP Access in Helidon
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:helidon:27.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:24.185Z

Reserved: 2026-09-28T15:40:09.493Z

Link: CVE-2026-101587

cve-icon Vulnrichment

Updated: 2026-10-22T18:43:27.232Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T22:18:12.150

Modified: 2026-10-22T19:17:34.507

Link: CVE-2026-101587

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T05:00:05Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption