Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Helidon's Imperative Web Server contains an Improper Access Control flaw (CWE-284) that allows unauthenticated HTTP requests to trigger a hang or crash, resulting in denial of service. This vulnerability affects versions 3.0.0 through 3.2.19. The CVSS 3.1 score of 7.5 reflects the high availability impact with no confidentiality or integrity impact.

Affected Systems

The affected product is Oracle’s Helidon Web Server, part of the Helidon component of Oracle Fusion Middleware. Vulnerable versions are 3.0.0 through 3.2.19. No newer major releases are listed as affected.

Risk and Exploitability

The flaw is considered easily exploitable; the attacker only needs network access to HTTP and no credentials. The CVSS score of 7.5 indicates a high availability impact with no confidentiality or integrity impact. Because the CVSS vector indicates a network attack with no authentication and a high availability impact, the risk is significant. The EPSS score is <1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating that no widespread public exploits have been reported yet, but the potential for a deterministic denial of service makes it a high‑priority issue.

Generated by OpenCVE AI on August 29, 2026 at 00:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Helidon to a version that includes the fix.
  • If a swift upgrade is unavailable, restrict inbound HTTP traffic to Helidon by placing it behind a firewall or reverse proxy and limiting access to trusted IP addresses.
  • Configure rate‑limiting or application rules to detect and block abnormal request patterns that could trigger the crash, reducing the window of opportunity for attackers.

Generated by OpenCVE AI on August 29, 2026 at 00:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Title Helidon Web Server Improper Access Control Allows Remote Denial of Service

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Title Helidon Web Server Improper Access Control Allows Remote Denial of Service

Thu, 20 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Title Helidon Web Server 3.2.20 Unauthenticated HTTP Denial-of-Service Vulnerability

Wed, 19 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Title Helidon Web Server 3.2.20 Unauthenticated HTTP Denial-of-Service Vulnerability

Wed, 19 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Request Causes Denial of Service in Helidon Web Server
Weaknesses CWE-749
CWE-770

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Request Causes Denial of Service in Helidon Web Server
Weaknesses CWE-749
CWE-770

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:3.2.20:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T17:18:21.218Z

Reserved: 2026-08-13T18:41:45.890Z

Link: CVE-2026-73927

cve-icon Vulnrichment

Updated: 2026-08-19T13:59:42.686Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:25.663

Modified: 2026-08-28T20:19:51.360

Link: CVE-2026-73927

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T00:45:04Z

Weaknesses