CVE-2026-101572

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Oracle Helidon

Publication date: 2026-10-20

Last updated on: 2026-10-22

Assigner: Oracle

Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-101572

EUVD

EUVD-2026-105980

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Helidon	4.0.0
Oracle Corporation	Helidon	27.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a denial-of-service (DoS) vulnerability in Oracle Helidon's webclient-http2 component. It allows an unauthenticated attacker to remotely crash the application by sending specially crafted HTTP/2 requests, causing repeated crashes or hangs.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of Oracle Helidon (4.0.0-4.5.5 or 27.0.0) running with HTTP/2 enabled. Inspect application logs for crashes or hangs, monitor network traffic for malformed HTTP/2 requests, and verify Helidon version via package managers or application metadata.

Impact Analysis

If you use affected versions of Helidon (4.0.0-4.5.5 or 27.0.0), an attacker could exploit this to make your application unavailable, disrupting services and causing downtime.

Compliance Impact

This vulnerability causes denial-of-service (DoS) conditions in Oracle Helidon, leading to system unavailability. Such disruptions may violate compliance requirements for availability in GDPR (data processing integrity) and HIPAA (system reliability for protected health information).

Mitigation Strategies

Update Helidon to a version that is not affected by this vulnerability. Affected versions are 4.0.0-4.5.5 and 27.0.0. Apply patches or upgrades as soon as possible to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-101572. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...