CVE-2026-87289: Oracle Helidon DOS Vulnerability

CVE-2026-87289 Overview

CVE-2026-87289 is a denial-of-service vulnerability in the Oracle Helidon product of Oracle Fusion Middleware. The flaw resides in the helidon-webserver-static-content component and affects supported versions 4.0.0 through 4.5.4. An unauthenticated attacker with network access over HTTP can trigger a hang or a repeatable crash, resulting in a complete denial of service of the Helidon server. The vulnerability is classified under CWE-400: Uncontrolled Resource Consumption. No confidentiality or integrity impact is associated with this issue; availability is the sole affected security property.

Critical Impact
Remote, unauthenticated attackers can crash or hang any Helidon 4.0.0–4.5.4 instance serving static content, taking the application fully offline.

Affected Products

Oracle Helidon 4.0.0 through 4.5.4
Oracle Fusion Middleware deployments using the helidon-webserver-static-content component
Applications built on Helidon WebServer that expose static assets over HTTP

Discovery Timeline

2026-09-15 - CVE-2026-87289 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87289

Vulnerability Analysis

The vulnerability resides in Helidon's static content handler, part of the WebServer module used to serve files from the classpath or filesystem. An unauthenticated remote attacker can send crafted HTTP requests that force the server into a state where it consumes resources without bound or terminates unexpectedly. The result is a hang or a repeatable crash, both of which produce a complete outage of the Helidon process.

Because Helidon runs as the application server for many Java microservices and Oracle Fusion Middleware workloads, a single unauthenticated request can remove a service from availability. Recovery requires restarting the affected process, and attackers can trivially reissue the request to keep the service down.

Root Cause

The root cause is uncontrolled resource consumption in the static content component, aligning with CWE-400. The static content pipeline fails to bound the work performed when processing certain HTTP requests, allowing an adversary to trigger CPU, memory, or thread exhaustion, or to reach an unrecoverable error path that crashes the server.

Attack Vector

Exploitation requires only network reachability to the Helidon HTTP endpoint that serves static content. No authentication, user interaction, or elevated privileges are needed. The attacker sends a specially crafted HTTP request to the static content route, and the server hangs or crashes on processing it. Oracle has not published exploitation details, and no public proof-of-concept exists at the time of writing. Refer to the Oracle Security Alert CSPUSEP2026 for vendor guidance.

Detection Methods for CVE-2026-87289

Indicators of Compromise

Unexpected termination or hang of the Helidon java process, followed by container or service restarts.
Spikes in HTTP request latency or 5xx responses on routes handled by helidon-webserver-static-content.
Repeated identical or malformed HTTP requests to static asset paths from a single source IP.
Thread dumps showing threads stuck inside the static content handler.

Detection Strategies

Monitor Helidon process uptime and correlate restarts with inbound HTTP traffic patterns.
Alert on abnormal request volume or malformed URI patterns targeting static resource paths.
Track JVM metrics (heap, thread count, GC pauses) for anomalies coinciding with static content requests.
Inspect reverse proxy or load balancer logs for repeated requests preceding backend outages.

Monitoring Recommendations

Enable HTTP access logging on Helidon and forward logs to a centralized analytics platform.
Collect JVM and container metrics with per-endpoint request duration histograms.
Configure health check probes that quickly detect a hung Helidon instance and trigger alerts.
Baseline normal traffic to static content routes so anomalies are visible in dashboards.

How to Mitigate CVE-2026-87289

Immediate Actions Required

Upgrade Helidon to a fixed version above 4.5.4 as identified in the Oracle Security Alert CSPUSEP2026.
Inventory all services built on Helidon 4.0.0–4.5.4 and prioritize internet-facing deployments.
Restrict network exposure of Helidon endpoints to trusted networks until patches are applied.
Enable rate limiting at the reverse proxy or WAF to reduce the blast radius of abusive requests.

Patch Information

Oracle addressed CVE-2026-87289 in the security alert referenced above. Administrators should apply the fixed Helidon release published in the Oracle Security Alert CSPUSEP2026 and validate that the helidon-webserver-static-content dependency in application pom.xml or build.gradle files resolves to the patched version.

Workarounds

Disable the static content service in Helidon configuration if the application does not require serving static assets.
Front Helidon with a hardened reverse proxy (for example, NGINX) that serves static files directly and blocks anomalous URIs.
Deploy WAF rules that drop malformed HTTP requests and enforce strict URI validation for static paths.
Apply per-IP connection and request rate limits to slow exploitation attempts while patching is scheduled.

bash

# Example: update Helidon dependency to the patched version in a Maven project
mvn versions:set-property -Dproperty=helidon.version -DnewVersion=<patched-version>
mvn clean verify

# Example: restrict exposure with an iptables allowlist until patched
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP