Oracle Helidon CVE-2026-101587

Exploitation targets the helidon-webclient-http1 HTTP/1.1 client component, so the realistic prerequisite is that a Helidon application (versions 4.0.0-4.5.5 or 27.0.0) uses the WebClient to make outbound HTTP/1.1 requests to a server whose responses an attacker can control or influence (e.g., a third-party API, redirect target, or SSRF-reachable endpoint). No authentication (PR:N) and no user interaction (UI:N) are required, and complexity is low (AC:L). The primary limiting factors are that impact is confined to a PARTIAL denial of service (A:L) with no data compromise, and that the vulnerable client code path must actually be invoked against an attacker-influenced HTTP endpoint - purely inbound-facing Helidon servers that never use the WebClient toward untrusted hosts are less exposed.

This is a medium-severity (CVSS 3.1 base 5.3) availability-only vulnerability in Oracle Helidon's helidon-webclient-http1 component. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates an unauthenticated, low-complexity, network-reachable flaw with no confidentiality or integrity impact and only a PARTIAL denial of service (A:L) - not a full crash or RCE. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. A key caveat the raw CVSS score obscures: the affected component is an HTTP/1.1 web CLIENT (helidon-webclient-http1), which strongly implies the DoS is triggered when a Helidon application issues outbound requests and processes a malicious/crafted server response, rather than by an attacker directly hitting a listening service - verify the direction of exploitation with Oracle. Overall this is a moderate-priority patch-management item, not an emergency: the partial-DoS impact, availability-only scope, and absence of KEV/POC/EPSS signals place it well below critical. Oracle labels it 'Easily exploitable,' which is consistent with AC:L/PR:N, but the practical risk hinges on whether the vulnerable code path is reachable in a given deployment.

An attacker who controls or can influence an HTTP server contacted by a Helidon application returns a specially crafted HTTP/1.1 response that the helidon-webclient-http1 component mishandles, causing a partial denial of service (e.g., thread/resource exhaustion or hang) in the client application. No authentication or user interaction is required and attack complexity is low, but impact is limited to degraded availability. No public exploit code is identified at time of analysis.