Live › vulnerability › CVE-2026-101579
Go to dashboardHelidon's gRPC server component, in versions 3.0.0 through 3.2.21, can be abused over HTTP/2 by an unauthenticated attacker with network access. A successful attack allows unauthorized reading, inserting, updating or deleting of some data Helidon can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on Helidon 3.0.0 through 3.2.21 that expose a gRPC server over HTTP/2 to a network are the ones at risk. Teams not using the helidon-grpc-server component, or running versions outside that range, can skip it.
No product ranges from the sources yet.
io.helidon dependencies, looking for versions from 3.0.0 to 3.2.21helidon-grpc-server3.2.21, as the sources do not name the exact fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server). Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101579")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.