This vulnerability affects Oracle Helidon 3.2.19 in the Imperative Web Server component. An unauthenticated attacker with network access via HTTP/2 can exploit the flaw to cause a hang or repeated crash, resulting in a complete denial of service. The CVSS 3.1 base score is 7.5, reflecting a high impact on availability with no impact on confidentiality or integrity. The vulnerability is publicly documented and included in Oracle's August 2026 Critical Security Patch Update. No specific patch or remediation details for this version are explicitly stated in the advisory content provided, but Oracle strongly recommends applying available patches from the Critical Security Patch Update.

Successful exploitation results in a denial of service condition by causing the Helidon server to hang or crash repeatedly. This impacts the availability of the affected system but does not compromise confidentiality or integrity.

Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among many others and strongly recommends that customers apply the relevant security patches without delay. Since no explicit patch link or remediation level is provided in the input, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Maintaining actively supported versions and timely patching is the primary mitigation.