CVE-2026-73896

Received Received - Intake

Unauthenticated Partial DoS in Helidon

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-73896

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	helidon	4.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Fusion Middleware's Helidon product, specifically in the Imperative Web Server component. It affects version 4.5.0 and allows an unauthenticated attacker to exploit it via HTTP/2 without needing access to the system or user interaction. The attack can lead to unauthorized access to some data and partial disruption of service.

Detection Guidance

To detect this vulnerability, check if your system is running Helidon version 4.5.0. Use commands like 'curl -I http://<target>:<port>' to inspect HTTP/2 responses for Helidon server headers. Network scanning tools like Nmap with service detection may also identify vulnerable instances.

Impact Analysis

An attacker could read some of your Helidon data and cause partial service outages. This might disrupt operations relying on Helidon but does not allow full system compromise or data modification.

Mitigation Strategies

Upgrade Helidon to a version unaffected by this vulnerability. If upgrading is not immediately possible, restrict network access to the HTTP/2 port using firewalls or disable HTTP/2 if not required. Monitor Oracle's security advisories for patches.

Hi! I’m here to help you understand CVE-2026-73896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70