CVE-2026-73937: Oracle Helidon DOS Vulnerability

CVE-2026-73937 Overview

CVE-2026-73937 is a high-severity vulnerability in the Imperative Web Server component of Oracle Helidon, part of Oracle Fusion Middleware. The flaw affects Helidon version 4.5.0 and can be triggered by an unauthenticated attacker with network access over HTTP/2. Successful exploitation causes a hang or repeatable crash resulting in complete denial of service, and also grants unauthorized read access to a subset of Helidon-accessible data. The weakness is classified under CWE-284 (Improper Access Control).

Critical Impact
An unauthenticated remote attacker can crash Helidon services over HTTP/2 and read a subset of application data without user interaction.

Affected Products

Oracle Helidon 4.5.0
Oracle Fusion Middleware deployments using the Imperative Web Server component
Applications built on Helidon SE/MP that expose HTTP/2 endpoints

Discovery Timeline

2026-08-18 - CVE-2026-73937 published to the National Vulnerability Database
2026-08-18 - Oracle Critical Patch Update advisory released (Oracle Security Alert)
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-73937

Vulnerability Analysis

The vulnerability resides in Helidon's Imperative Web Server, which handles HTTP/2 traffic for applications built on the Oracle Helidon microservices framework. An unauthenticated attacker sends crafted HTTP/2 traffic across the network to trigger the flaw. The attack requires no privileges, no user interaction, and low attack complexity, making it trivial to weaponize against exposed endpoints.

Exploitation produces two distinct outcomes. The first is a hang or frequently repeatable crash that yields complete denial of service of the Helidon runtime. The second is unauthorized read access to a subset of data accessible to the Helidon process, resulting in confidentiality loss without any impact to integrity.

Root Cause

The root cause is improper access control (CWE-284) within the HTTP/2 request-handling path of the Imperative Web Server. Insufficient enforcement of access boundaries allows unauthenticated clients to reach code paths that should be restricted, and to trigger conditions that destabilize the server process.

Attack Vector

The attack vector is network-based and targets any Helidon 4.5.0 instance exposing HTTP/2. An attacker delivers crafted HTTP/2 frames to a reachable listener. Because no authentication is required, internet-facing Helidon services and internal services reachable via lateral movement are equally exposed. Oracle has not published proof-of-concept code, and no public exploit is currently listed in Exploit-DB or CISA KEV.

No verified proof-of-concept code is available. Refer to the Oracle Security Alert for vendor-supplied technical details.

Detection Methods for CVE-2026-73937

Indicators of Compromise

Repeated Helidon process crashes, restarts, or unresponsive HTTP/2 listeners in service logs.
Bursts of malformed or anomalous HTTP/2 frames from a single source IP against Helidon endpoints.
Unexplained spikes in outbound data volume from Helidon services to unauthorized clients.
Elevated 5xx error rates or connection resets on HTTP/2 listeners bound to Helidon 4.5.0.

Detection Strategies

Inventory all Oracle Helidon deployments and flag any instance running version 4.5.0 for prioritized monitoring.
Correlate web server access logs with process supervisor events to detect crash-restart cycles that align with HTTP/2 traffic patterns.
Deploy network signatures on WAF or IDS platforms that inspect HTTP/2 frames and alert on protocol anomalies targeting Helidon services.

Monitoring Recommendations

Ingest Helidon application logs, JVM crash dumps, and reverse-proxy access logs into a central SIEM for correlation.
Alert on repeated HTTP/2 protocol errors or GOAWAY frames tied to a single client identifier.
Track baseline response sizes for Helidon endpoints and alert on statistically significant deviations that may indicate data exposure.

How to Mitigate CVE-2026-73937

Immediate Actions Required

Identify every Helidon 4.5.0 deployment across production, staging, and development environments.
Apply the Oracle Critical Patch Update fix documented in the Oracle Security Alert.
Restrict inbound HTTP/2 access to Helidon services using network access control lists until patching is complete.
Enable rate limiting and connection quotas on upstream proxies fronting Helidon endpoints.

Patch Information

Oracle addressed CVE-2026-73937 in the August 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for the fixed version and upgrade instructions specific to their Helidon deployment model.

Workarounds

Front Helidon with a reverse proxy that terminates HTTP/2 and forwards HTTP/1.1 to the Helidon backend where architecturally feasible.
Disable HTTP/2 support on affected Helidon 4.5.0 listeners if the application can operate over HTTP/1.1.
Enforce IP allow-listing on Helidon endpoints so that only trusted clients can initiate HTTP/2 sessions.

bash

# Example: restrict Helidon HTTP/2 exposure at the host firewall
# Allow only trusted upstream proxy 10.0.0.10 to reach Helidon on port 8443
iptables -A INPUT -p tcp --dport 8443 -s 10.0.0.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP