CVE-2026-73882

Modified Modified - Updated After Analysis

Denial of Service in Helidon

Publication date: 2026-08-18

Last updated on: 2026-08-28

Assigner: Oracle

Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-28

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-73882

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	helidon	3.2.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a denial-of-service (DoS) vulnerability in Oracle Helidon's Imperative Web Server component, affecting version 3.2.19. An unauthenticated attacker can exploit it remotely via HTTP to crash or hang the server repeatedly, causing complete service disruption.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual HTTP requests targeting Helidon servers. Check server logs for repeated crashes or hangs. Use tools like curl to test endpoints for responsiveness. Example command: curl -v http://<target-ip>:<port> to verify service availability.

Impact Analysis

If you use Oracle Helidon 3.2.19, an attacker could make your web server unavailable, leading to downtime and loss of service for users. This could disrupt applications relying on Helidon for web services.

Compliance Impact

This vulnerability causes denial-of-service (DOS) conditions in Oracle Helidon, leading to system unavailability. For GDPR, this could impact data processing operations requiring continuous availability. For HIPAA, it may disrupt critical healthcare systems, potentially violating access and integrity requirements.

Mitigation Strategies

Apply the latest Oracle Helidon patch or upgrade to a non-vulnerable version. Restrict network access to Helidon servers via firewalls. Disable unnecessary HTTP endpoints. Monitor for signs of exploitation like repeated crashes.

Hi! I’m here to help you understand CVE-2026-73882. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70