CVE-2026-73890 Overview
CVE-2026-73890 is a denial of service vulnerability in the Imperative Web Server component of Oracle Helidon, part of Oracle Fusion Middleware. The flaw affects Helidon version 4.5.0 and is exploitable by unauthenticated attackers over the network via HTTP/2. Successful exploitation causes a hang or a repeatable crash, resulting in complete denial of service of the Helidon runtime. The weakness is categorized as improper access control [CWE-284] and impacts availability only, with no confidentiality or integrity effects.
Critical Impact
An unauthenticated remote attacker can trigger a full denial of service of Helidon 4.5.0 by sending crafted HTTP/2 traffic to the Imperative Web Server.
Affected Products
- Oracle Helidon 4.5.0
- Oracle Fusion Middleware (Helidon component)
- Imperative Web Server subcomponent
Discovery Timeline
- 2026-08-18 - CVE-2026-73890 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-73890
Vulnerability Analysis
The vulnerability resides in the Imperative Web Server component of Oracle Helidon, a Java microservices framework. An unauthenticated attacker with network access to the HTTP/2 endpoint can send crafted requests that cause the server to hang or crash in a reliably repeatable manner. The result is a complete outage of the Helidon runtime and any services it hosts.
Because the attack targets the HTTP/2 handling path, exploitation does not require valid credentials, user interaction, or elevated privileges. Any exposed Helidon 4.5.0 instance accepting HTTP/2 connections is reachable by remote adversaries.
Root Cause
Oracle classifies the weakness under [CWE-284] (Improper Access Control) in the Imperative Web Server. The advisory does not disclose implementation details, but the impact profile is consistent with resource exhaustion or an unhandled protocol state triggered during HTTP/2 request processing. See the Oracle Security Alert August 2026 for vendor-provided technical context.
Attack Vector
The attack vector is network-based over HTTP/2. An attacker only needs reachability to the Helidon HTTP/2 listener to send malformed or abusive protocol frames that force the process into a hang state or a crash loop. Repeatable crash behavior makes the flaw suitable for sustained service disruption rather than transient impact.
No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2026-73890 at the time of publication. The EPSS probability is 0.3%.
Detection Methods for CVE-2026-73890
Indicators of Compromise
- Repeated or abrupt termination of the Helidon java process serving HTTP/2 traffic without a preceding application-level error.
- Unusual spikes in inbound HTTP/2 SETTINGS, HEADERS, or CONTINUATION frames from a single source or small set of sources.
- Sudden increase in TCP resets or half-open connections on the Helidon HTTP/2 listener port.
- Extended request-processing latency followed by service unavailability on Helidon 4.5.0 workloads.
Detection Strategies
- Alert on abnormal HTTP/2 request rates, malformed frame counts, or protocol errors logged by Helidon.
- Correlate container or JVM restarts with inbound HTTP/2 traffic patterns to identify crash-triggering sources.
- Deploy network intrusion detection signatures for known HTTP/2 abuse patterns such as rapid stream creation and reset floods.
Monitoring Recommendations
- Monitor Helidon process uptime, thread count, and heap usage on all 4.5.0 instances until patched.
- Track HTTP/2 error frame metrics and connection reset counters exposed by the Helidon web server.
- Forward Helidon and JVM logs to a centralized analytics platform to identify recurring crash signatures tied to remote peers.
How to Mitigate CVE-2026-73890
Immediate Actions Required
- Inventory all Oracle Helidon deployments and identify hosts running version 4.5.0 with HTTP/2 enabled.
- Apply the fix published in the Oracle Security Alert August 2026 as soon as it is validated in a non-production environment.
- Restrict network exposure of the Helidon HTTP/2 listener to trusted clients using firewalls or service mesh policies.
- Rate-limit inbound HTTP/2 traffic at an upstream proxy or load balancer to reduce crash-loop feasibility.
Patch Information
Oracle addresses this vulnerability in the August 2026 Critical Patch Update. Refer to the Oracle Security Alert August 2026 for patched build numbers and upgrade instructions for Helidon 4.5.0 deployments.
Workarounds
- Disable HTTP/2 on the Imperative Web Server and serve traffic over HTTP/1.1 where operationally acceptable.
- Front Helidon with a reverse proxy that terminates HTTP/2 and forwards HTTP/1.1 to the backend.
- Enforce strict HTTP/2 frame and stream limits at the edge to blunt malformed request attacks.
- Isolate Helidon 4.5.0 workloads behind authenticated network segments until the patch is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
