Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Helidon versions 3.0.0 through 3.2.18 contain a vulnerability that allows an unauthenticated attacker with network access via HTTP to cause the Imperative Web Server to hang or repeatedly crash, resulting in a loss of availability for the Helidon instance. The flaw permits a denial‑of‑service attack without requiring authentication or privileged access, and it carries a CVSS v3.1 Base Score of 7.5.

Affected Systems

The affected product is Oracle Helidon versions 3.0.0 through 3.2.18. No other products are listed as impacted.

Risk and Exploitability

Based on the description, it is inferred that the vulnerability exposes an unprotected HTTP endpoint that can be accessed from outside the network; attackers do not require credentials or special privileges and simply need network connectivity to the Helidon service. With a high impact on availability, the CVSS score of 7.5 reflects the severity. The EPSS score is less than 1%, indicating a very low but nonzero exploitation probability, and the issue is not listed in CISA's KEV catalog. If exploited, the attack would cause a permanent or repeatable denial of service, disrupting any applications relying on Helidon.

Generated by OpenCVE AI on August 28, 2026 at 23:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a Helidon version newer than 3.2.18 when the patch is released by Oracle.
  • If an upgrade cannot be performed immediately, block or restrict inbound traffic to the Helidon HTTP port using firewalls or network segmentation so that only trusted hosts can reach the vulnerable service.
  • Apply the Oracle security patch referenced in the oracle.com/security-alerts/cspuaug2026.html advisory once it becomes available to address the Helidon defect.

Generated by OpenCVE AI on August 28, 2026 at 23:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title Oracle Helidon Denial‑of‑Service via Unauthenticated HTTP Access

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Tue, 25 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Title Oracle Helidon Denial‑of‑Service via Unauthenticated HTTP Access

Tue, 25 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Helidon 3.2.19 HTTP Endpoint Vulnerability Enables Service Denial
Weaknesses CWE-770

Tue, 25 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
Title Helidon 3.2.19 HTTP Endpoint Vulnerability Enables Service Denial
Weaknesses CWE-770

Thu, 20 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Helidon 3.2.19 Unauthenticated HTTP Denial of Service
Weaknesses CWE-770

Wed, 19 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Title Helidon 3.2.19 Unauthenticated HTTP Denial of Service
Weaknesses CWE-770

Wed, 19 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-based Denial of Service in Oracle Helidon 3.2.19
Weaknesses CWE-770

Wed, 19 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-based Denial of Service in Oracle Helidon 3.2.19
Weaknesses CWE-770

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:3.2.19:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T16:44:53.263Z

Reserved: 2026-08-13T18:41:45.883Z

Link: CVE-2026-73882

cve-icon Vulnrichment

Updated: 2026-08-25T01:33:52.971Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:20.620

Modified: 2026-08-28T20:19:46.847

Link: CVE-2026-73882

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T23:45:03Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption