Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Helidon product of Oracle Fusion Middleware faces a flaw in its imperative web server that allows an unauthenticated attacker with network access via HTTP/2 to cause the application to hang or crash, resulting in a complete denial of service. The vulnerability affects supported versions 3.0.0 through 3.2.18 and is rated a CVSS base score of 7.5, reflecting a high availability impact. Attackers do not need credentials or user interaction to exploit this flaw.

Affected Systems

Oracle Helidon versions 3.0.0 through 3.2.18 are affected, with the flaw located in the imperative web server component of Oracle Fusion Middleware.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 emphasizes the serious availability impact achievable by an unauthenticated attacker with network access. The EPSS score of <1% indicates that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits. Nonetheless, the attack vector involves standard HTTP/2 requests that could be sent from any reachable host, making the scenario highly plausible if the attacker gains network access to the Helidon instance.

Generated by OpenCVE AI on August 28, 2026 at 23:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Block or limit HTTP/2 traffic to Helidon instances with firewalls or load balancers until a vendor update is available.
  • Disable HTTP/2 support in Helidon’s configuration if network restrictions cannot be applied, thereby removing the vulnerable request handling code.
  • Monitor Oracle’s security advisories for updates or patches for Helidon 3.2.19 and apply any available fixes promptly.

Generated by OpenCVE AI on August 28, 2026 at 23:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title Helidon HTTP/2 Denial of Service Vulnerability

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Title Helidon HTTP/2 Denial of Service Vulnerability

Thu, 20 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP/2 Denial of Service in Helidon Web Server

Wed, 19 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP/2 Denial of Service in Helidon Web Server

Wed, 19 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP/2 Denial of Service in Oracle Helidon 3.2.19
Weaknesses CWE-400
CWE-779

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP/2 Denial of Service in Oracle Helidon 3.2.19
Weaknesses CWE-400
CWE-779

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:3.2.19:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T17:23:00.429Z

Reserved: 2026-08-13T18:41:45.891Z

Link: CVE-2026-73934

cve-icon Vulnrichment

Updated: 2026-08-19T13:59:37.888Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:26.453

Modified: 2026-08-28T20:19:51.813

Link: CVE-2026-73934

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T23:45:03Z

Weaknesses