Threats affecting pkg:maven/io.helidon/helidon-webserver-http2

CVE-2026-101570 is a vulnerability in Oracle Fusion Middleware's Helidon webserver HTTP/2 component affecting versions 4.0.0 through 4.5.5. It allows an unauthenticated attacker with network access via HTTP/2 to cause a partial denial of service (DoS). The vulnerability is rated low severity with a CVSS 3.1 base score of 3.7, impacting availability only. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, indicating that patches are available for affected versions.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).