{"id":"CVE-2026-101581","kind":"vulnerability","aliases":["CVE-2026-101581"],"related":[],"title":"Helidon: DNS round-robin resolver flaw lets network attackers alter data and disrupt service","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-dns-resolver-round-robin).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","summary":"Oracle Helidon's helidon-webclient-dns-resolver-round-robin component contains a flaw exploitable over DNS by an unauthenticated network attacker. A successful attack can allow limited unauthorized data modification and partial denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helidon","java","oracle","package","self-hosted"],"not_affected_if":["unused-dns-resolver-module"],"how_to_check":"- Check the Helidon version in the project's dependency file (for example `pom.xml` or `build.gradle`) for `io.helidon` artifacts at `4.0.0` through `4.5.5` or `27.0.0`\n- Check whether the project uses the `helidon-webclient-dns-resolver-round-robin` module","fix":"- Upgrade Helidon to a release newer than the affected range (4.0.0-4.5.5 and 27.0.0); the exact fixed version is unknown from the sources\n- Consult Oracle's July 2026 Critical Patch Update advisory for the patched release number","status":"open","published_at":"2026-10-20T22:18:11+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:55:13+00:00","updated_at":"2026-10-25T03:55:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:55:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Helidon to a release newer than the affected range (4.0.0-4.5.5 and 27.0.0); the exact fixed version is unknown from the sources\n- Consult Oracle's July 2026 Critical Patch Update advisory for the patched release number","reach":"network","title":"Helidon: DNS round-robin resolver flaw lets network attackers alter data and disrupt service","impact":"medium","summary":"Oracle Helidon's helidon-webclient-dns-resolver-round-robin component contains a flaw exploitable over DNS by an unauthenticated network attacker. A successful attack can allow limited unauthorized data modification and partial denial of service.","category":"package","nicknames":[],"who_cares":["java","helidon","oracle","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker alters some accessible data and partly disrupts service","analyst_note":"Find the fixed Helidon version in Oracle's advisory for this CVE and confirm the DNS round-robin module's default usage.","how_to_check":"- Check the Helidon version in the project's dependency file (for example `pom.xml` or `build.gradle`) for `io.helidon` artifacts at `4.0.0` through `4.5.5` or `27.0.0`\n- Check whether the project uses the `helidon-webclient-dns-resolver-round-robin` module","needs_analyst":true,"not_affected_if":["unused-dns-resolver-module"],"who_is_affected":"Applications that use Helidon's webclient with the DNS round-robin resolver module on versions 4.0.0 through 4.5.5 or 27.0.0 are exposed. Systems that do not use that module or run other Helidon versions can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":3508,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101581':18A,21A '-2026':17A,20A '/av':153C '27.0.0':91C '3.1':141C,152C '4.0.0':88C '4.5.5':89C '6.5':144C 'abil':128C 'access':100C,119C,124C 'affect':86C 'allow':55B,95C 'alter':11A 'attack':10A,50B,53B,97C,107C 'avail':147C 'base':142C 'caus':130C 'compon':39B,74C 'compromis':104C 'contain':40B 'cve':16A,19A 'cvss':140C,149C,151C 'data':12A,58B,125C 'delet':118C 'denial':62B,133C 'disrupt':14A 'dns':2A,35B,45B,78C,102C 'dos':137C 'easili':92C 'exploit':43B,93C 'flaw':7A,42B 'fusion':72C 'helidon':1A,22B,30B,33B,68C,76C,105C,123C,139C 'helidon-webclient-dns-resolver-round-robin':32B,75C 'host':28B 'impact':148C 'insert':116C 'integr':145C 'java':23B 'l':161C 'l/a':160C 'l/pr':155C 'let':8A 'limit':56B 'middlewar':73C 'modif':59B 'n/ac':154C 'n/i':159C 'n/s':157C 'n/ui':156C 'network':9A,49B,99C 'oracl':24B,29B,71C 'packag':25B 'partial':61B,132C,136C 'product':69C 'resolv':6A,36B,79C 'result':112C 'robin':5A,38B,81C 'round':4A,37B,80C 'round-robin':3A 'score':143C 'self':27B 'self-host':26B 'servic':15A,64B,135C 'success':52B,106C 'support':82C 'u/c':158C 'unauthent':48B,96C 'unauthor':57B,114C,127C 'updat':115C 'vector':150C 'version':83C 'via':101C 'vulner':65C,94C,110C 'webclient':34B,77C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Helidon's webclient with the DNS round-robin resolver module on versions 4.0.0 through 4.5.5 or 27.0.0 are exposed. Systems that do not use that module or run other Helidon versions can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101581","severity":null,"published_at":"2026-10-20T22:18:11+00:00","modified_at":"2026-10-22T19:17:34+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}