Live › vulnerability › CVE-2026-101572
Go to dashboardHelidon's HTTP/2 web client component has a flaw that an unauthenticated attacker on the network can trigger over HTTP/2. Successful exploitation hangs or repeatedly crashes the Helidon application, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
The sources list Helidon 4.0.0 through 4.5.5 and 27.0.0 as affected, specifically the helidon-webclient-http2 component. Teams running those versions with the HTTP/2 client in use should look closer. Teams on other versions can skip it on this evidence.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| helidon-webclient-http2 | maven | >= 4.0.0, <= 4.5.5; 27.0.0 | – |
4.0.0-4.5.5 or 27.0.0: run mvn dependency:tree or gradle dependencies and grep helidon-webclient-http24.5.6 (4.x line) or 27.0.1 (27.x line); not confirmed against Oracle's Helidon risk matrix rowEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-101572")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.