Oracle Helidon CVE-2026-73902

No special configuration or non-default settings are required - the vulnerability exists in the default operational mode of the Helidon 3.2.19 Imperative Web Server when accessible over HTTP from the network. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires only network connectivity to the HTTP port; no authentication, no user interaction, and no special deployment configuration is needed. Exploitation is limited to Helidon version 3.2.19 specifically (other versions not confirmed affected), and only the Imperative Web Server component is implicated - deployments using only Helidon's reactive/non-blocking server model may not be affected, though this distinction is not confirmed by the advisory.

The CVSS 7.5 High score accurately reflects the straightforward exploitability: network-reachable, no authentication, no user interaction, low complexity. The impact is scoped entirely to availability - there is no confidentiality or integrity component - which limits the blast radius to service disruption rather than data compromise. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, reducing immediate threat urgency relative to actively exploited issues. Helidon has a relatively limited deployment footprint compared to mainstream Java frameworks, which further constrains real-world exposure; however, any team running Helidon 3.2.19 as an internet-facing or intranet microservice endpoint - even a mid-sized municipal IT team in boleslawiec managing internal services - should treat this as urgent given the zero-barrier exploitation path. The primary concern is targeted disruption of microservice infrastructure rather than opportunistic mass exploitation.

An unauthenticated remote attacker identifies a Helidon 3.2.19 Imperative Web Server endpoint accessible over HTTP and sends a specially crafted HTTP request designed to trigger a hang or crash in the request-processing logic. The server becomes unresponsive or terminates, causing a complete denial of service for all users of that microservice. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests the trigger condition is not difficult to reproduce once discovered.