This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. An unauthenticated attacker can exploit this flaw remotely over HTTP to cause the Helidon server to hang or crash repeatedly, resulting in a complete denial of service. The CVSS 3.1 base score is 7.5, reflecting the high impact on availability with no impact on confidentiality or integrity. The affected versions are 4.0.0 through 4.5.0 inclusive, and 4.5.1. Oracle's August 2026 Critical Security Patch Update advisory lists this vulnerability among many others and strongly recommends applying patches promptly. However, the provided data does not include explicit patch availability or fixed version details for this specific vulnerability.

Successful exploitation results in a complete denial of service (DoS) condition by causing the Helidon server to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without authentication via HTTP network access.

Oracle recommends that customers remain on actively supported versions and apply security patches without delay. The August 2026 Critical Security Patch Update advisory includes this vulnerability among many fixes. Although explicit patch links or fixed versions for CVE-2026-73936 are not provided in the input data, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Patch status is not yet confirmed from the provided data — check the vendor advisory for current remediation guidance.