Live › vulnerability › CVE-2026-101569
Go to dashboardOracle's Helidon Java framework has a flaw in its concurrency-limits component that lets an unauthenticated remote attacker send HTTP requests that change or delete some data the service can access and partly disrupt the service. The attack needs no login and no user action, and the CVSS base score is 6.5 (medium).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on the Helidon framework that include the helidon-common-concurrency-limits component and are reachable over HTTP from a network are exposed, as the sources list affected versions 4.0.0 through 4.5.5 and 27.0.0. Teams not running Helidon, or running versions outside the affected range, can skip it.
No product ranges from the sources yet.
helidon-common-concurrency-limits or the Helidon BOM; affected versions are 4.0.0 through 4.5.5 and 27.0.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-concurrency-limits). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
This page as .md · .json · in your agent: get_signal("CVE-2026-101569")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.