Helidon CVE-2026-87289

|

EUVD

EUVD-2026-79938 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-09-15 secalert_us@oracle.com

GHSA-683w-v5xf-4gr4

Denial Of Service Oracle Helidon

7.5

CVSS 3.1 · Vendor: oracle

View

Vulnerability Assessment

Weakness

CWE

OWASP Top 10:2025

A06:2025 - Insecure Design

ASVS 5.0

V2 - Validation and Business Logic Resource consumption limits

MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Sep 15, 2026

Unauthenticated remote denial of service in Oracle Helidon versions 4.0.0 through 4.5.4, specifically the helidon-webserver-static-content component, allows a network attacker to hang or repeatedly crash the server via HTTP and render the application unavailable (CVSS 3.1 base 7.5, A:H only). Oracle characterizes the flaw as easily exploitable (AV:N/AC:L/PR:N/UI:N/S:U), but no public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis, so active exploitation is unconfirmed. Impact is availability-only: there is no reported confidentiality or integrity loss.

Affected VersionsENISA

Helidon 4.0.0 ≤4.5.4

Affected Packages

euvd helidon no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Helidon gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Threat Intelligence Overview

EPSS Score

0.5%

Top 61% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

38

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Helidon

View all

CVE-2021-29425 MEDIUM This Month POC

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/

CVE-2026-73930 CRITICAL Act Now

Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac

CVE-2026-71164 CRITICAL Act Now

Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic

CVE-2026-71152 CRITICAL Act Now

Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web

CVE-2026-71074 CRITICAL Act Now

Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u

CVE-2026-73921 CRITICAL Act Now

Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe

CVE-2026-73912 CRITICAL Act Now

Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c

CVE-2026-73905 CRITICAL Act Now

Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper

CVE-2026-71166 CRITICAL Act Now

Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read

CVE-2026-73920 CRITICAL Act Now

Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach

CVE-2026-71167 CRITICAL Act Now

Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle

CVE-2026-71065 CRITICAL Act Now

Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

CVE-2021-21341 HIGH POC

CVE-2022-29885 HIGH POC

CVE-2026-45498 HIGH POC

CVE-2016-8610 HIGH

CVE-2026-28318 HIGH POC

CVE-2023-38180 HIGH

CVE-2025-26673 HIGH

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-87289 REF https://www.oracle.com/security-alerts/cspusep2026.html

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy