This vulnerability affects Oracle Helidon 4.5.1, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP/2 to cause a hang or frequent crash, resulting in a complete denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. The vendor advisory does not explicitly confirm a patch or remediation level but strongly encourages applying security patches as part of Oracle's Critical Security Patch Update process. The advisory lists Helidon 4.5.1 among affected versions but does not specify a fixed version.

Successful exploitation results in denial of service by causing the Helidon server to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without authentication, making it a significant availability risk for affected systems running Helidon 4.5.1.

Oracle recommends applying security patches promptly as part of their Critical Security Patch Update process. Although no specific patch or remediation level is explicitly stated for this vulnerability, customers should monitor Oracle's advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Maintaining up-to-date versions and applying Oracle's security updates without delay is strongly advised.