Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Helidon’s Imperative Web Server component contains a flaw that permits an unauthenticated attacker with network access via HTTP/2 to send crafted traffic, causing the server to hang or repeatedly crash. Successful attacks can result in an unauthorized ability to cause a hang or repeatable crash (complete Denial of Service) of Helidon. Supported versions 4.0.0 through 4.5.0 are affected. The weakness is reflected in the CVSS 3.1 score of 7.5, indicating a strong availability compromise with low complexity and no prerequisite. CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected Systems

Oracle Helidon versions 4.0.0 through 4.5.0 are affected. The flaw exists in the Helidon Imperative Web Server component of Oracle Fusion Middleware. No other product versions are listed.

Risk and Exploitability

The CVSS base score of 7.5 highlights a significant availability impact, while the EPSS score of < 1% indicates that the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog, but because it is easily exploitable and requires only network access via HTTP/2, the potential for disruptive attacks in environments that expose Helidon to the internet remains high. An unauthenticated attacker can trigger the denial of service by establishing an HTTP/2 connection.

Generated by OpenCVE AI on August 28, 2026 at 22:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a Helidon version that includes the security fix issued by Oracle.
  • If an upgrade is not immediately possible, disable HTTP/2 support on the Helidon server to block the exploit path.
  • Apply network filtering or rate-limiting controls to block or throttle high-volume HTTP/2 requests from untrusted clients.

Generated by OpenCVE AI on August 28, 2026 at 22:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server HTTP/2 Denial of Service Vulnerability

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server HTTP/2 Denial of Service Vulnerability

Thu, 20 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server HTTP/2 Denial of Service Vulnerability

Wed, 19 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Title Helidon HTTP/2 Denial of Service Vulnerability
Weaknesses CWE-400

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Title Helidon HTTP/2 Denial of Service Vulnerability
Weaknesses CWE-400

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T17:23:39.209Z

Reserved: 2026-08-13T18:41:45.891Z

Link: CVE-2026-73935

cve-icon Vulnrichment

Updated: 2026-08-19T13:59:35.260Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:26.570

Modified: 2026-08-28T20:19:51.923

Link: CVE-2026-73935

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T22:45:05Z

Weaknesses