Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in Oracle Helidon’s Imperative Web Server allows an unauthenticated attacker with network access via HTTP to compromise the application. Successful exploitation can cause the server to hang or crash repeatedly, resulting in a full denial of service.

Affected Systems

Oracle Helidon versions 4.0.0 through 4.4.1 are affected. The vulnerability resides in the Imperative Web Server component that handles HTTP requests within the Fusion Middleware stack.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score is < 1%, showing a low likelihood of exploitation. Because the attack requires no authentication or privileges, a remote attacker can still target the system. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 28, 2026 at 23:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply the latest Oracle Helidon update or vendor‑supplied patch that addresses the HTTP request handling flaw.
  • If a patch is not immediately available, limit inbound HTTP access to Helidon by configuring firewall rules or network segmentation to only allow trusted networks.
  • After applying the patch or tightening access controls, redeploy Helidon and verify that the server remains available under normal traffic patterns.

Generated by OpenCVE AI on August 28, 2026 at 23:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Oracle Helidon 4.5.0 HTTP Request Handling Denial of Service

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Title Oracle Helidon 4.5.0 HTTP Request Handling Denial of Service

Thu, 20 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Helidon 4.5.0 HTTP Request Handling Vulnerability Causing Denial of Service

Wed, 19 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Helidon 4.5.0 HTTP Request Handling Vulnerability Causing Denial of Service

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T17:17:32.237Z

Reserved: 2026-08-13T18:41:45.888Z

Link: CVE-2026-73915

cve-icon Vulnrichment

Updated: 2026-08-19T13:59:46.625Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:24.370

Modified: 2026-08-28T20:19:50.897

Link: CVE-2026-73915

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T23:15:04Z

Weaknesses