CVE-2026-71161

Oracle Helidon 3.2.18's Imperative Web Server component allows an unauthenticated, network-accessible attacker to trigger a partial denial of service via HTTP. CVSS 3.1 scores it MEDIUM (5.3). Exploitation details are not provided; refer to Oracle's August 2026 CPU advisory for patch information.