EUVD-2026-105978

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-101570

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

io.helidon.webclient:helidon-webclient-grpc (>=27.0.0-m1, <=27.0.0), io.helidon.webclient:helidon-webclient-grpc-tracing (>=27.0.0-m1, <=27.0.0) +3 more potentially affected by CVE-2026-101572 via io.helidon.webclient:helidon-webclient-http2 (>=27.0.0-m1, <=27.0.0)

io.helidon.webclient:helidon-webclient-http2 MAVEN version =27.0.0-m1, =27.0.0-m1, =27.0.0-m1, =27.0.0-m1, =27.0.0-m1, =27.0.0-m1, =27.0.0 Source cves: CVE-2026-101572 Source advisory: MEND:CVE-2026-101572...

CVE-2026-101570

A vulnerability exists in the helidon-webserver-http2 component of the Helidon product within Oracle Fusion Middleware . Affected versions range from 4.0.0 to 4.5.5 . An unauthenticated attacker with network access via HTTP/2 can exploit this difficulty-to-exploit vulnerability to cause a partial...

PT-2026-119250

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

Oracle Helidon security vulnerabilities

Oracle Helidon versions 4.0.0 to 4.5.5 have security vulnerabilities. These vulnerabilities stem from issues with the helidon-webserver-http2 component. The vulnerabilities are difficult to exploit, and unauthenticated attackers can cause denial-of-service attacks by accessing through HTTP/2...

CVE-2026-83281

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Helidon. Successful attacks of this...

CVE-2026-87289

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...

com.buralotech.oss.identifier:buralotech-identifier-helidonmp (>=3.1.0, <=3.1.1), com.open-elements:recordstore-server (>=0.1.0, <=0.10.0) +46 more potentially affected by CVE-2026-87289 via io.helidon.webserver:helidon-webserver-static-content (>=4.0.0-m2, <=4.5.4)

io.helidon.webserver:helidon-webserver-static-content MAVEN version =4.0.0-m2, =3.1.0, =0.1.0, =1.15.0.516, =0.4.0, =1.2-rc4, =0.11, =1.0.0, =1.4.0, =1.0.0, =4.0.0-m2, =4.0.0-m2, =4.0.0-rc2, =4.0.0-m2, =4.5.4 and more Source cves: CVE-2026-87289 Source advisory:...

io.helidon:helidon-all (27.0.0-m1) potentially affected by CVE-2026-87289 via io.helidon.webserver:helidon-webserver-static-content (27.0.0-m1)

io.helidon.webserver:helidon-webserver-static-content MAVEN version 27.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.helidon.webserver:helidon-webserver-static-content and may be impacted: - io.helidon:helidon-all 27.0.0-m1 Source cves:...

CVE-2026-83281

CVE-2026-83281 is a Denial-of-Service vulnerability in Oracle Fusion Middleware Helidon , specifically the helidon-webserver component, affecting versions 4.0.0 through 4.5.4 . An unauthenticated attacker with network access via TCP can cause a hang or frequently repeatable crash, resulting in a ...

com.akilisha.oss:cafeai-agents (>=0.2.0, <=0.3.2), com.akilisha.oss:cafeai-connect (>=0.1.2, <=0.3.2) +55 more potentially affected by CVE-2026-83280 via io.helidon.webserver:helidon-webserver-http2 (>=4.0.0-m2, <=4.5.4)

io.helidon.webserver:helidon-webserver-http2 MAVEN version =4.0.0-m2, =0.2.0, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.9.9, =0.9.9, =3.3.1, =3.2.0, =3.3.0 and more Source cves: CVE-2026-83280 Source advisory: MEND:CVE-2026-83280...

CVE-2026-83280

CVE-2026-83280 is a Denial of Service vulnerability in Oracle Helidon (component: helidon-webserver-http2 ), part of Oracle Fusion Middleware. Affected versions are 4.0.0 through 4.5.4 . An unauthenticated attacker with network access can send crafted requests via HTTP/2 to cause a hang or freque...

CVE-2026-83280

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-83281

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Helidon. Successful attacks of this...

io.helidon.webserver.testing.junit5:helidon-webserver-testing-junit5-grpc (27.0.0-m1), io.helidon.webserver.testing.junit5:helidon-webserver-testing-junit5-http2 (27.0.0-m1) +5 more potentially affected by CVE-2026-83280 via io.helidon.webserver:helidon-webserver-http2 (27.0.0-m1)

io.helidon.webserver:helidon-webserver-http2 MAVEN version 27.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.helidon.webserver:helidon-webserver-http2 and may be impacted: -...

CVE-2026-87289: Uncontrolled Resource Consumption

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...

CVE-2026-83281: Uncontrolled Resource Consumption

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Helidon. Successful attacks of this...

CVE-2026-83280: Uncontrolled Resource Consumption

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

PT-2026-92803

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 Description A flaw in the helidon-webserver component allows an unauthenticated attacker with network access via TCP to compromise the system. This can lead to a hang or a frequentl...