CVE-2026-73902

Modified Modified - Updated After Analysis

Denial of Service in Oracle Helidon

Publication date: 2026-08-18

Last updated on: 2026-08-28

Assigner: Oracle

Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-28

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-73902

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	helidon	3.2.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a denial-of-service (DoS) vulnerability in Oracle Helidon's Imperative Web Server, affecting version 3.2.19. An unauthenticated attacker can exploit it remotely via HTTP to crash the server repeatedly or cause a complete hang, making it unavailable.

Detection Guidance

To detect this vulnerability, monitor for crashes or hangs in the Helidon Imperative Web Server version 3.2.19. Check server logs for HTTP requests causing unexpected terminations. Use network scanning tools to identify exposed Helidon instances on port 80 or 443.

Impact Analysis

If you use the affected Helidon version, an attacker could disrupt your web services by crashing the server, leading to downtime and loss of availability for your applications.

Compliance Impact

This DoS vulnerability could violate availability requirements in GDPR (Article 32) and HIPAA (Security Rule), potentially leading to non-compliance if it disrupts access to personal or health data.

Mitigation Strategies

Upgrade Helidon to a version unaffected by this vulnerability. If upgrading is not immediately possible, restrict network access to the Helidon server via firewall rules or disable the Imperative Web Server component if unused.

Hi! I’m here to help you understand CVE-2026-73902. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70