CVE-2026-83280

CVE-2026-83280 is a denial-of-service flaw in the helidon-webserver-http2 component of Oracle Helidon, part of Oracle Fusion Middleware, affecting versions 4.0.0 through 4.5.4. An unauthenticated remote attacker who can reach the Helidon web server over the network via HTTP/2 can send crafted requests that cause the server to hang or repeatedly crash, resulting in a complete denial of service. The vulnerability is rated 7.5 (high) on CVSS 3.1, with network attack vector, low attack complexity, no privileges or user interaction required, and high availability impact only (no confidentiality or integrity impact). Any organization running an affected Helidon 4.x release with the HTTP/2-enabled web server exposed to clients or untrusted networks is affected. No public proof-of-concept is known and the flaw is not on the CISA Known Exploited Vulnerabilities catalog as of this writing.

What to do: Upgrade Helidon to a release newer than 4.5.4 that contains the fix from Oracle's Critical Patch Update as soon as possible. Until patched, restrict network access to Helidon HTTP/2 listeners (e.g., via firewall rules or an API gateway) or disable HTTP/2 in the webserver configuration, and monitor for hangs or repeated crashes indicative of abuse.