Oracle Helidon CVE-2026-101570

Requires that the target expose the Helidon WebServer's HTTP/2 listener (helidon-webserver-http2 component) reachable over the network on an affected release (4.0.0 through 4.5.5); exploitation proceeds without authentication or user interaction (PR:N/UI:N). The primary LIMITING factor is high attack complexity (AC:H): Oracle describes it as 'difficult to exploit,' implying the attacker must meet conditions outside their control (such as specific server state, resource conditions, or timing) to trigger the fault. Impact is bounded to a PARTIAL denial of service - degraded, not total, loss of availability - and no data exposure or modification is possible (C:N/I:N).

This is a low-priority, low-real-risk issue despite being remotely reachable without authentication. The CVSS 3.1 base score is only 3.7 (Low), driven entirely by a partial availability impact (A:L) with no confidentiality or integrity impact (C:N/I:N). Oracle explicitly labels it 'difficult to exploit' (AC:H), meaning successful attack requires conditions beyond the attacker's control (e.g., specific timing, resource states, or race conditions in the HTTP/2 stack). The vector is network-based and unauthenticated (AV:N/PR:N/UI:N), which raises exposure, but the only outcome is a partial denial of service of Helidon - not a crash, full outage, or code execution. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. The signals are consistent rather than conflicting: a genuinely low-severity DoS where the network attack vector is offset by high attack complexity and limited (partial) impact. No SSVC decision data was provided. Treat this as routine patch-cycle remediation, not an emergency.

A remote attacker with no credentials sends specially crafted or malformed HTTP/2 traffic to a Helidon-based service's WebServer endpoint, exploiting a flaw in the helidon-webserver-http2 component to degrade service availability (partial DoS). Because the CVSS vector specifies high attack complexity (AC:H), the attacker must satisfy conditions outside their direct control - such as a specific server state or timing window - so reliable triggering is non-trivial. No public exploit code is identified in the provided data.