CVE-2026-83276: Oracle Helidon HTTP/2 DOS Vulnerability

CVE-2026-83276 Overview

CVE-2026-83276 is a denial of service vulnerability in the Helidon product of Oracle Fusion Middleware. The flaw resides in the helidon-webclient-http2 component and affects supported versions 4.0.0 through 4.5.4. An unauthenticated attacker with network access over HTTP/2 can compromise Helidon availability. Successful exploitation causes a hang or a frequently repeatable crash, resulting in a complete denial of service. The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption. Oracle disclosed the issue in Security Alert CSPUSEP2026.

Critical Impact
Remote unauthenticated attackers can trigger a complete denial of service of Helidon instances via crafted HTTP/2 traffic without any user interaction.

Affected Products

Oracle Fusion Middleware Helidon 4.0.0 through 4.5.4
Component: helidon-webclient-http2
Applications embedding the affected Helidon WebClient HTTP/2 module

Discovery Timeline

2026-09-15 - CVE-2026-83276 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83276

Vulnerability Analysis

The vulnerability affects the HTTP/2 client implementation in Helidon's WebClient module. Helidon is Oracle's lightweight Java microservices framework, and the WebClient provides both HTTP/1.1 and HTTP/2 client capabilities. The defect allows a remote attacker to send crafted HTTP/2 traffic that the client fails to handle safely. The result is either a process hang or a repeatable crash of the Helidon runtime. Because the attack vector is the network and no authentication or user interaction is required, exploitation is straightforward against any exposed service that initiates or accepts HTTP/2 exchanges through the vulnerable component. The EPSS score is 0.338% at publication.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] within the HTTP/2 handling code path of helidon-webclient-http2. HTTP/2 introduces stateful features such as stream multiplexing, flow control windows, HPACK header compression, and settings frames. When these features are not bounded or validated correctly, a peer can force the client into excessive memory allocation, unbounded loops, or fatal exception states. Oracle has not published low-level technical detail, but the effect described in the advisory is consistent with resource-exhaustion patterns observed across HTTP/2 stacks.

Attack Vector

An attacker sends malicious HTTP/2 responses or frames to a Helidon WebClient that connects to attacker-controlled or attacker-influenced endpoints. Any Helidon 4.x microservice that performs outbound HTTP/2 calls to untrusted services is exposed. Exploitation requires only network reachability between the client and the malicious HTTP/2 peer. The impact is limited to availability; confidentiality and integrity are not affected. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical details.

Detection Methods for CVE-2026-83276

Indicators of Compromise

Repeated crashes or restarts of Helidon microservice processes correlated with outbound HTTP/2 connections
Sudden memory or CPU spikes in Java Virtual Machine (JVM) processes running Helidon WebClient
Unexpected thread hangs or stalled request queues in Helidon runtime logs
HTTP/2 protocol errors or malformed frame exceptions in application logs

Detection Strategies

Inventory all services using Helidon 4.0.0 through 4.5.4 and identify those making outbound HTTP/2 calls
Enable verbose logging on helidon-webclient-http2 to capture protocol-level anomalies
Correlate service crash events with network flows to external HTTP/2 endpoints
Monitor container orchestrators for elevated restart counts on Helidon workloads

Monitoring Recommendations

Track JVM heap and thread metrics for Helidon services via Java Management Extensions (JMX) or OpenTelemetry
Alert on service liveness probe failures and pod restart loops in Kubernetes
Capture packet metadata for outbound HTTP/2 sessions to atypical destinations
Ingest Helidon application logs into a centralized SIEM for behavioral baselining

How to Mitigate CVE-2026-83276

Immediate Actions Required

Identify all applications built on Helidon versions 4.0.0 through 4.5.4
Apply the fixed release referenced in the Oracle Security Alert CSPUSEP2026 as soon as available
Restrict outbound HTTP/2 connectivity from Helidon services to trusted destinations only
Deploy egress filtering or a forward proxy that validates HTTP/2 traffic

Patch Information

Oracle addressed this vulnerability in the September 2026 Security Alert. Review the Oracle Security Alert CSPUSEP2026 for the fixed Helidon version and upgrade instructions. Upgrading helidon-webclient-http2 to the patched release is the definitive remediation.

Workarounds

Configure Helidon WebClient to use HTTP/1.1 for outbound requests where HTTP/2 is not required
Route outbound HTTP/2 calls through a hardened reverse proxy that normalizes frames
Enforce strict allow-lists for outbound service destinations
Set aggressive JVM resource limits and liveness probes to contain crash impact until patching is complete

bash

# Example: pin Helidon WebClient to HTTP/1.1 in application.yaml
client:
  protocol-preference: ["http/1.1"]
  connect-timeout: PT5S
  read-timeout: PT10S