Oracle Helidon CVE-2026-101569

No special conditions - remote unauthenticated exploitation over HTTP against default configurations of Oracle Helidon in affected versions (4.0.0 through 4.5.5, and 27.0.0), consistent with AV:N/AC:L/PR:N/UI:N. Exploitation requires only that the Helidon service expose an HTTP endpoint reachable by the attacker and that it uses the helidon-common-concurrency-limits component. Limiting factors: impact is bounded (no confidentiality loss, only partial integrity and partial availability), the scope is unchanged (no pivot beyond the Helidon process), and environments on unaffected/patched versions or that restrict network reachability to the service are not exposed.

This is a moderate-severity issue (CVSS 3.1 base 6.5) driven by a favorable attack profile rather than high impact: the Oracle-supplied vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated, no-user-interaction flaw, which maximizes exploitability, but the impact is capped at partial integrity (I:L) and partial availability (A:L) with no confidentiality loss (C:N) and no scope change (S:U). The affected component (helidon-common-concurrency-limits) and the 'Denial Of Service' tag suggest the real-world effect is bypassing or exhausting concurrency/rate-limiting controls, enabling a partial DoS and limited unauthorized data modification. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; the only exploitation signal is the inherently easy attack vector asserted by the vendor. Net assessment: a credible, easy-to-reach vulnerability worth patching in the normal Oracle CPU cycle, but NOT an emergency - treat as medium priority absent any exploitation telemetry. Key missing data: no EPSS probability and no KEV/POC status to confirm whether this is being targeted; CWE is listed as N/A, so the precise weakness class is unconfirmed.

An unauthenticated attacker with network access sends crafted HTTP requests to a Helidon service to abuse the concurrency-limits component, bypassing throttling controls to exhaust server capacity and cause a partial denial of service, while also achieving limited unauthorized modification of some Helidon-accessible data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are needed. No public exploit code was identified in the provided intelligence.