CVE-2026-73935: Oracle Helidon DOS Vulnerability

CVE-2026-73935 Overview

CVE-2026-73935 is a denial-of-service vulnerability in the Imperative Web Server component of Oracle Helidon, part of Oracle Fusion Middleware. An unauthenticated remote attacker can send crafted HTTP/2 traffic to trigger a hang or a frequently repeatable crash, resulting in complete service unavailability. The flaw affects Oracle Helidon version 4.5.1 and is classified under CWE-284: Improper Access Control. Oracle addressed the issue in the Oracle Critical Patch Update Advisory - August 2026.

Critical Impact
Unauthenticated network attackers can crash or hang Helidon web servers over HTTP/2, producing a complete denial of service without authentication or user interaction.

Affected Products

Oracle Helidon 4.5.1
Oracle Fusion Middleware deployments embedding the Helidon Imperative Web Server
Applications and microservices built on the affected Helidon runtime

Discovery Timeline

2026-08-18 - CVE-2026-73935 published to the National Vulnerability Database (NVD)
2026-08-18 - Oracle publishes the August 2026 Critical Patch Update advisory
2026-08-21 - Last updated in the NVD database

Technical Details for CVE-2026-73935

Vulnerability Analysis

The vulnerability resides in the Imperative Web Server component of Oracle Helidon 4.5.1. The server mishandles specific HTTP/2 traffic patterns processed over the network. An attacker with only network reachability to the HTTP/2 listener can trigger the fault repeatedly. Successful exploitation causes the Helidon runtime to hang or crash, taking the affected service offline. Because Helidon frequently hosts microservices and API gateways, a single failing instance can cascade into downstream service disruption. The advisory categorizes the weakness under CWE-284: Improper Access Control, indicating the server accepts or processes protocol traffic it should reject.

Root Cause

Oracle attributes the flaw to the Imperative Web Server's handling of HTTP/2 requests. The component does not adequately constrain or validate certain protocol interactions, allowing malformed or abusive frames to drive the runtime into an unrecoverable state. Oracle has not published low-level implementation details in the public advisory.

Attack Vector

Exploitation requires only network access to an HTTP/2 endpoint exposed by a Helidon 4.5.1 deployment. No credentials, prior access, or user interaction are needed. An attacker sends crafted HTTP/2 frames to the listener and forces the server to hang or terminate. The attack is repeatable, so an adversary can maintain sustained denial of service by resending the trigger against restarted instances.

No public proof-of-concept exploit code is available. See the Oracle Security Alert for vendor technical details.

Detection Methods for CVE-2026-73935

Indicators of Compromise

Repeated Helidon process crashes or thread-pool exhaustion correlated with inbound HTTP/2 sessions
Unusual volumes of HTTP/2 GOAWAY, RST_STREAM, or malformed frames targeting Helidon listeners
Sudden loss of /health or /ready endpoint availability on Helidon 4.5.1 workloads
Application logs showing abrupt termination of the Imperative Web Server without a graceful shutdown

Detection Strategies

Inspect HTTP/2 traffic at the ingress or service mesh layer for abnormal frame sequences directed at Helidon services
Alert on repeated container restarts or JVM exits for Helidon 4.5.1 workloads in orchestration platforms such as Kubernetes
Correlate application crash events with source IP addresses initiating HTTP/2 sessions to identify repeatable triggers

Monitoring Recommendations

Track uptime, restart counts, and request-error rates for every Helidon service exposing HTTP/2
Forward Helidon runtime logs and orchestration events to a centralized analytics platform for correlation
Baseline normal HTTP/2 client behavior and alert on deviations such as high RST_STREAM rates or malformed frame counts

How to Mitigate CVE-2026-73935

Immediate Actions Required

Inventory all Oracle Helidon deployments and identify instances running version 4.5.1
Apply the fixes from the Oracle Critical Patch Update - August 2026 as the primary remediation
Restrict network exposure of Helidon HTTP/2 listeners to trusted clients until patching completes
Enable automated restart and health-check policies to reduce outage duration if exploitation occurs

Patch Information

Oracle released fixes for CVE-2026-73935 as part of the August 2026 Critical Patch Update. Administrators should upgrade Helidon to the patched release identified in the Oracle Security Alert and validate the fix in staging before rolling out to production.

Workarounds

Disable HTTP/2 on affected Helidon listeners and serve traffic over HTTP/1.1 where feasible
Terminate HTTP/2 at an upstream reverse proxy, load balancer, or service mesh that is not affected by this issue
Apply rate limiting and connection quotas to HTTP/2 clients to reduce the impact of repeated exploitation attempts
Isolate Helidon services behind network access controls that limit HTTP/2 traffic to authenticated peers

bash

# Configuration example: disable HTTP/2 in Helidon application.yaml as a temporary workaround
server:
  port: 8080
  protocols:
    http_1_1:
      enabled: true
    http_2:
      enabled: false