Oracle Helidon CVE-2026-73934

Exploitation requires network access to the Helidon Imperative Web Server over the HTTP/2 protocol - no authentication, no special permissions, and no user interaction are needed. The specific vulnerability resides in the Imperative (synchronous) Web Server component, meaning deployments using only Helidon's reactive (Nima) server may not be affected, though this is inferred from component naming and is not explicitly confirmed by the advisory. The affected version is specifically 3.2.19. Deployments behind an HTTP/1.1-only reverse proxy that does not forward HTTP/2 connections to the backend have a reduced but potentially non-zero attack surface, depending on whether the proxy exposes any HTTP/2 path to Helidon. No non-default configuration flag is cited as required; any running instance of the affected version serving HTTP/2 traffic appears vulnerable.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately captures an easily exploitable, unauthenticated network-reachable DoS - a profile that demands prompt remediation for any internet-facing or intranet-accessible Helidon deployment; even a mid-sized municipal IT team in gliwice running Helidon-based microservices should treat this as an operational priority rather than a deferred patch. EPSS data is not available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. The absence of a KEV listing and confirmed POC lowers short-term exploitation urgency, though the low attack complexity means the barrier to independent discovery is minimal. Impact is purely availability (C:N/I:N/A:H), so confidentiality and integrity are unaffected - the practical risk is service disruption rather than data breach. The HTTP/2 specificity is a meaningful constraint: deployments proxied behind an HTTP/1.1 gateway that does not forward HTTP/2 may have reduced but not eliminated exposure, depending on internal routing.

An unauthenticated remote attacker sends a sequence of crafted HTTP/2 requests to an exposed Helidon 3.2.19 Imperative Web Server endpoint, triggering a hang or repeated crash of the server process. Because no authentication is required and attack complexity is low, the scenario is repeatable and does not require prior foothold - a script sending malformed HTTP/2 frames or exploiting a specific protocol-level condition would suffice. No public proof-of-concept code has been identified at time of analysis, but the low complexity rating suggests the technique is likely straightforward once the triggering condition is identified.