{"id":"CVE-2026-101570","kind":"vulnerability","aliases":["CVE-2026-101570"],"related":[],"title":"Helidon: HTTP/2 flaw lets unauthenticated network attacker partly crash server","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2).  Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","summary":"Helidon's HTTP/2 web server component (helidon-webserver-http2) has a flaw that an unauthenticated attacker can reach over the network via HTTP/2. A successful attack causes a partial denial of service, degrading availability without exposing data.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helidon","java","package","self-hosted"],"not_affected_if":["default-config","no-http2-exposure"],"how_to_check":"- Check the Helidon version in the project build file (for example the `io.helidon` dependency version in `pom.xml` or `build.gradle`) and see whether it falls in `4.0.0` through `4.5.5`.\n- Confirm whether the application uses the `helidon-webserver-http2` artifact.","fix":"- Move Helidon to a version newer than `4.5.5` as listed in the Oracle advisory; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-20T22:18:10+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:43:59+00:00","updated_at":"2026-10-25T04:43:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:43:59Z","model":"claude-haiku-5-5","output":{"fix":"- Move Helidon to a version newer than `4.5.5` as listed in the Oracle advisory; the exact fixed version is unknown from the sources.","reach":"internet","title":"Helidon: HTTP/2 flaw lets unauthenticated network attacker partly crash server","impact":"low","summary":"Helidon's HTTP/2 web server component (helidon-webserver-http2) has a flaw that an unauthenticated attacker can reach over the network via HTTP/2. A successful attack causes a partial denial of service, degrading availability without exposing data.","category":"package","nicknames":[],"who_cares":["helidon","java","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Partial denial of service of the Helidon server","analyst_note":"Find the Oracle security alert for CVE-2026-101570 to confirm the fixed Helidon version and whether HTTP/2 must be enabled.","how_to_check":"- Check the Helidon version in the project build file (for example the `io.helidon` dependency version in `pom.xml` or `build.gradle`) and see whether it falls in `4.0.0` through `4.5.5`.\n- Confirm whether the application uses the `helidon-webserver-http2` artifact.","needs_analyst":true,"not_affected_if":["default-config","no-http2-exposure"],"who_is_affected":"Applications built on Helidon 4.0.0 through 4.5.5 that serve HTTP/2 traffic through the helidon-webserver-http2 component are exposed to network-reachable denial of service. Teams running other Helidon versions, or services that do not expose HTTP/2 to untrusted networks, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000653,"input_tokens":3455,"output_tokens":614,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101570':13A,16A '-2026':12A,15A '/av':130C '3.1':120C,129C '3.7':123C '4.0.0':81C '4.5.5':82C 'abil':107C 'access':92C 'affect':79C 'allow':87C 'attack':7A,39B,49B,89C,99C 'avail':57B,124C 'base':121C 'caus':50B,109C 'compon':28B,70C 'compromis':96C 'crash':9A 'cve':11A,14A 'cvss':119C,126C,128C 'data':60B 'degrad':56B 'denial':53B,112C 'difficult':83C 'dos':116C 'exploit':85C 'expos':59B 'flaw':3A,35B 'fusion':68C 'h/pr':132C 'helidon':1A,17B,23B,30B,64C,72C,97C,118C 'helidon-webserver-http2':29B,71C 'host':22B 'http/2':2A,25B,46B,94C 'http2':32B,74C 'impact':125C 'java':18B 'l':138C 'let':4A 'middlewar':69C 'n/a':137C 'n/ac':131C 'n/i':136C 'n/s':134C 'n/ui':133C 'network':6A,44B,91C 'oracl':67C 'packag':19B 'part':8A 'partial':52B,111C,115C 'product':65C 'reach':41B 'result':104C 'score':122C 'self':21B 'self-host':20B 'server':10A,27B 'servic':55B,114C 'success':48B,98C 'support':75C 'u/c':135C 'unauthent':5A,38B,88C 'unauthor':106C 'vector':127C 'version':76C 'via':45B,93C 'vulner':61C,86C,102C 'web':26B 'webserv':31B,73C 'without':58B","nicknames":[],"mitigations":[],"who_affected":"Applications built on Helidon 4.0.0 through 4.5.5 that serve HTTP/2 traffic through the helidon-webserver-http2 component are exposed to network-reachable denial of service. Teams running other Helidon versions, or services that do not expose HTTP/2 to untrusted networks, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101570","severity":null,"published_at":"2026-10-20T22:18:10+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}