Live › vulnerability › CVE-2026-101570
Go to dashboardHelidon's HTTP/2 web server component (helidon-webserver-http2) has a flaw that an unauthenticated attacker can reach over the network via HTTP/2. A successful attack causes a partial denial of service, degrading availability without exposing data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on Helidon 4.0.0 through 4.5.5 that serve HTTP/2 traffic through the helidon-webserver-http2 component are exposed to network-reachable denial of service. Teams running other Helidon versions, or services that do not expose HTTP/2 to untrusted networks, can skip it.
No product ranges from the sources yet.
io.helidon dependency version in pom.xml or build.gradle) and see whether it falls in 4.0.0 through 4.5.5.helidon-webserver-http2 artifact.4.5.5 as listed in the Oracle advisory; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
This page as .md · .json · in your agent: get_signal("CVE-2026-101570")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.