Oracle Helidon CVE-2026-73935

No special conditions are required beyond network access to the Helidon service's HTTP/2 port - exploitation is remote and unauthenticated against the default configuration of Helidon 4.5.1's Imperative Web Server. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no elevated privileges, no user interaction, and no complex preconditions. The primary limiting factor is version specificity: only Helidon 4.5.1 is confirmed affected, so deployments running other versions are not in scope per current data. Additional limiting factors include network segmentation (internal-only deployments behind firewalls are exposed only to internal threat actors) and HTTP/2 availability (if the service is fronted by a proxy that downgrades to HTTP/1.1, the attack vector may be eliminated at the proxy layer).

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the real-world risk profile: the vulnerability is trivially reachable over the network, requires zero authentication, and produces complete service disruption. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified; however, the combination of AV:N/AC:L/PR:N/UI:N meets the textbook definition of an 'easily exploitable' vulnerability per Oracle's own severity rubric. The vulnerability has not been added to the CISA KEV catalog, and no public proof-of-concept exploit code is known, which tempers immediate urgency. The impact is strictly availability - no data exfiltration or integrity compromise is possible - which limits blast radius to service disruption. For organizations running Helidon in internet-facing or critical-path microservice roles, the practical risk is significant due to low exploitation complexity. For internal-only deployments with network segmentation, the effective risk is lower. The narrow version scope (4.5.1 only) also limits the exposed population.

An unauthenticated attacker discovers a Helidon 4.5.1 service with its HTTP/2 port exposed, then sends specially crafted HTTP/2 frames or streams designed to trigger the defect in the Imperative Web Server's request handling logic. The service enters a hung or crash state, resulting in complete unavailability for legitimate clients. No public proof-of-concept exploit code has been identified, but the low attack complexity means a working exploit could be independently developed without sophisticated resources.