---
id: "CVE-2026-101581"
kind: "vulnerability"
aliases: ["CVE-2026-101581"]
title: "Helidon: DNS round-robin resolver flaw lets network attackers alter data and disrupt service"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["helidon", "java", "oracle", "package", "self-hosted"]
not_affected_if: ["unused-dns-resolver-module"]
published_at: "2026-10-20T22:18:11+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:55:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101581", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Helidon: DNS round-robin resolver flaw lets network attackers alter data and disrupt service

Oracle Helidon's helidon-webclient-dns-resolver-round-robin component contains a flaw exploitable over DNS by an unauthenticated network attacker. A successful attack can allow limited unauthorized data modification and partial denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Helidon version in the project's dependency file (for example `pom.xml` or `build.gradle`) for `io.helidon` artifacts at `4.0.0` through `4.5.5` or `27.0.0`
- Check whether the project uses the `helidon-webclient-dns-resolver-round-robin` module

## Fix

- Upgrade Helidon to a release newer than the affected range (4.0.0-4.5.5 and 27.0.0); the exact fixed version is unknown from the sources
- Consult Oracle's July 2026 Critical Patch Update advisory for the patched release number

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101581

## From the sources

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-dns-resolver-round-robin).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_