{"id":"CVE-2026-101587","kind":"vulnerability","aliases":["CVE-2026-101587"],"related":[],"title":"Helidon HTTP/1 web client: unauthenticated request can cause partial denial of service","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","summary":"Helidon's HTTP/1 web client component (helidon-webclient-http1) affects versions 4.0.0 through 4.5.5 and 27.0.0, according to the sources. An unauthenticated attacker with network access over HTTP can cause a partial denial of service, with no confidentiality or integrity impact.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helidon","java","oracle-fusion-middleware","package"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the Helidon version in the project's build file (for example `pom.xml` or `build.gradle`) and look for `helidon-webclient-http1` in the dependency tree\n- Run `mvn dependency:tree | grep helidon-webclient-http1` or the Gradle equivalent to confirm the resolved version","fix":"- Move `helidon-webclient-http1` and related Helidon artifacts to a version outside the affected ranges 4.0.0-4.5.5 and 27.0.0; the sources do not name the fixed version\n- Check the Oracle advisory for the patched release number","status":"open","published_at":"2026-10-20T22:18:12+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:23:16+00:00","updated_at":"2026-10-25T04:23:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:23:16Z","model":"claude-haiku-5-5","output":{"fix":"- Move `helidon-webclient-http1` and related Helidon artifacts to a version outside the affected ranges 4.0.0-4.5.5 and 27.0.0; the sources do not name the fixed version\n- Check the Oracle advisory for the patched release number","reach":"network","title":"Helidon HTTP/1 web client: unauthenticated request can cause partial denial of service","impact":"low","summary":"Helidon's HTTP/1 web client component (helidon-webclient-http1) affects versions 4.0.0 through 4.5.5 and 27.0.0, according to the sources. An unauthenticated attacker with network access over HTTP can cause a partial denial of service, with no confidentiality or integrity impact.","category":"package","nicknames":[],"who_cares":["helidon","java","oracle-fusion-middleware"],"confidence":0.6,"needs_auth":"no","worst_case":"Partial denial of service against the affected Helidon application","analyst_note":"Find the fixed version and the triggering request path in Oracle's Critical Patch Update advisory for this CVE; the NVD entry alone does not give them.","how_to_check":"- Check the Helidon version in the project's build file (for example `pom.xml` or `build.gradle`) and look for `helidon-webclient-http1` in the dependency tree\n- Run `mvn dependency:tree | grep helidon-webclient-http1` or the Gradle equivalent to confirm the resolved version","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Applications that use the Helidon HTTP/1 web client to make outbound HTTP calls, in the affected version ranges, are potentially exposed. The sources do not describe which request path triggers the flaw, so unknown whether only specific client usage is reachable. Teams not using Helidon, or running versions outside the listed ranges, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":3460,"output_tokens":682,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101587':15A,18A '-2026':14A,17A '/av':138C '27.0.0':42B,91C '3.1':128C,137C '4.0.0':38B,88C '4.5.5':40B,89C '5.3':131C 'abil':115C 'access':52B,100C 'accord':43B 'affect':36B,86C 'allow':95C 'attack':49B,97C,107C 'avail':132C 'base':129C 'caus':8A,56B,117C 'client':4A,30B 'compon':31B,77C 'compromis':104C 'confidenti':64B 'cve':13A,16A 'cvss':127C,134C,136C 'denial':10A,59B,120C 'dos':124C 'easili':92C 'exploit':93C 'fusion':23B,75C 'helidon':1A,19B,26B,33B,71C,79C,105C,126C 'helidon-webclient-http1':32B,78C 'http':54B,102C 'http/1':2A,28B 'http1':35B,81C 'impact':67B,133C 'integr':66B 'java':20B 'l':146C 'l/pr':140C 'middlewar':24B,76C 'n/a':145C 'n/ac':139C 'n/i':144C 'n/s':142C 'n/ui':141C 'network':51B,99C 'oracl':22B,74C 'oracle-fusion-middlewar':21B 'packag':25B 'partial':9A,58B,119C,123C 'product':72C 'request':6A 'result':112C 'score':130C 'servic':12A,61B,122C 'sourc':46B 'success':106C 'support':82C 'u/c':143C 'unauthent':5A,48B,96C 'unauthor':114C 'vector':135C 'version':37B,83C 'via':101C 'vulner':68C,94C,110C 'web':3A,29B 'webclient':34B,80C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Helidon HTTP/1 web client to make outbound HTTP calls, in the affected version ranges, are potentially exposed. The sources do not describe which request path triggers the flaw, so unknown whether only specific client usage is reachable. Teams not using Helidon, or running versions outside the listed ranges, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101587","severity":null,"published_at":"2026-10-20T22:18:12+00:00","modified_at":"2026-10-22T19:17:34+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}