Oracle Helidon CVE-2026-73937

Exploitation requires network access to a Helidon 4.5.0 instance running the Imperative Web Server component over HTTP/2 - no authentication, session token, or user interaction is needed. The CVSS vector (PR:N/AC:L) and Oracle's 'easily exploitable' classification confirm zero prerequisites beyond connectivity. The key limiting factor is the specific product and version: only Helidon 4.5.0 using the Imperative Web Server (not the reactive Helidon WebServer) over HTTP/2 is confirmed affected. Deployments that terminate HTTP/2 at a reverse proxy and forward HTTP/1.1 to Helidon backend would reduce direct exposure, though the proxy itself must handle HTTP/2 correctly. The confidentiality impact (C:L) is limited in scope - full data exfiltration is not implied by the available description.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) scores 8.2 and accurately reflects the threat model: any unauthenticated attacker with HTTP/2 network access can trivially trigger a crash with no barriers. Oracle's own description uses the phrase 'easily exploitable,' reinforcing the low attack complexity. The primary real-world risk is availability - the A:H rating indicates complete, repeatable service disruption. The C:L impact is secondary and its scope (what data is exposed) is undefined in available data. No EPSS score is present in the provided intelligence, and the vulnerability is not listed in CISA KEV, so there is no confirmed active exploitation. No public POC has been identified. Despite the absence of known exploitation, the trivial exploitation path (unauthenticated, network, low complexity) means any internet-facing Helidon 4.5.0 deployment running the Imperative Web Server over HTTP/2 should treat this as high priority for patching. The absence of a CWE and the dual impact type suggest the vulnerability may involve HTTP/2 request handling that simultaneously corrupts or leaks state.

An external attacker sends a specially crafted HTTP/2 request (or sequence of frames) to a publicly accessible Helidon 4.5.0 service running the Imperative Web Server. The malformed HTTP/2 interaction triggers a processing fault that causes the server to hang indefinitely or crash, taking the application offline. Depending on the specific flaw, the attacker may also receive a partial response containing a fragment of data from another request or internal buffer.