Threats affecting pkg:maven/io.helidon/helidon-webclient-http2

CVE-2026-101572 is a high-severity vulnerability in Oracle Fusion Middleware's Helidon product, specifically in the helidon-webclient-http2 component. It affects Helidon versions 4.0.0 through 4.5.5 and version 27.0.0. The flaw allows an unauthenticated attacker with network access via HTTP/2 to cause a denial of service by hanging or crashing the Helidon service. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant impact on availability without affecting confidentiality or integrity.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).