Oracle Helidon CVE-2026-101572

The vulnerable code resides in Helidon's HTTP/2 WebClient (helidon-webclient-http2), so exploitation requires that the application actually use the HTTP/2 client path and process attacker-influenced HTTP/2 traffic - the most plausible model is the Helidon service initiating or accepting an HTTP/2 connection to/from an attacker-controlled or malicious endpoint. Affected deployments are Helidon 4.0.0 through 4.5.5 and 27.0.0. Limiting factors: no authentication is required (PR:N) and no user interaction (UI:N), but the HTTP/2 WebClient feature must be in use and the malicious HTTP/2 peer must be reachable by the application; impact is confined to availability (process hang/crash) with no confidentiality or integrity consequence. Verify with Oracle whether the trigger is an inbound request to a Helidon server or an outbound client connection, as this determines real-world reachability.

This is a genuine but bounded availability risk rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact - purely a denial-of-service (hang or repeatable complete crash). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' A key signal to reconcile: the affected component is helidon-webclient-http2, Helidon's OUTBOUND HTTP/2 client, which suggests the vulnerable code path is triggered when a Helidon application acts as an HTTP/2 client connecting to a malicious/crafted server, rather than a server endpoint an attacker can hit directly. The description nonetheless frames it as an 'attacker with network access via HTTP/2' compromising Helidon - this apparent tension between 'webclient' component and a server-style attack narrative should be verified against the Oracle advisory, because it materially changes who can reach the flaw (direct inbound request vs. the app being induced to make an outbound HTTP/2 call, e.g., via SSRF or a configured upstream). Overall: a real patch-worthy issue (availability-only, no data exposure), but absent KEV/EPSS/POC it is a routine prioritized DoS fix, not a drop-everything item.

A Helidon-based service using the HTTP/2 WebClient is induced to connect to an attacker-controlled or malicious HTTP/2 endpoint (or an attacker with network access delivers crafted HTTP/2 frames), which drives the client into a hang or repeatedly crashes the process, producing a complete denial of service. Because AC:L and PR:N/UI:N, no authentication or user interaction is required once the vulnerable HTTP/2 path is reachable. No public exploit code was identified in the provided data.