Helidon CVE-2026-73890

The target must be running Oracle Helidon version 4.5.0 with the Imperative Web Server component deployed and HTTP/2 enabled - HTTP/2 is the explicit and exclusive attack protocol named in Oracle's advisory; the vulnerability is not exercisable over HTTP/1.1. No authentication is required, and the CVSS vector (PR:N, UI:N, AC:L) confirms no user interaction and no unusual preconditions beyond network reachability. Limiting factors include: the scope is version-specific to 4.5.0 with no other versions confirmed affected; impact is strictly denial-of-service with no data exfiltration or code execution; and deployments behind network controls that restrict HTTP/2 access to trusted internal ranges significantly reduce practical exposure.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the advisory description: remotely exploitable with no credentials, no user interaction, and no special preconditions beyond network reachability over HTTP/2. Impact is strictly confined to availability - complete denial-of-service through hang or crash - with no confidentiality or integrity dimension, which materially limits the blast radius relative to code execution classes. No EPSS score was provided, so exploitation probability cannot be independently quantified. The CVE is absent from the CISA KEV catalog, indicating no confirmed in-the-wild exploitation at time of analysis. From an SSVC perspective, the 'automatable' signal is strong - the attack is network-delivered, unauthenticated, and low complexity - meaning even a mid-sized municipal IT team in sanok running Helidon 4.5.0-based microservices should treat patch application as timely, particularly for internet-facing deployments. Overall, this is a genuine operational risk warranting prompt remediation but not an emergency requiring immediate emergency response absent exploitation evidence.

An unauthenticated attacker with network access sends a sequence of crafted HTTP/2 frames - for example, malformed HEADERS, DATA, or SETTINGS frames designed to exploit a parsing fault or unbounded resource allocation in the Imperative Web Server - causing the server process to hang indefinitely or crash. Because the attack requires no credentials, no user interaction, and involves low complexity, it can be scripted for repeated automated triggering, sustaining a complete denial-of-service against any exposed Helidon 4.5.0 endpoint. No public proof-of-concept has been identified at time of analysis.