CVE-2026-73935: 
Homebrew vulnerability analysis and mitigation

CVE-2026-73935 is a denial-of-service vulnerability in the Imperative Web Server component of Oracle Helidon, a microservices framework under Oracle Fusion Middleware. The vulnerability affects Helidon version 4.5.1 and allows unauthenticated remote attackers to cause the server to hang or crash repeatedly via crafted HTTP/2 requests. It was disclosed on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU) for August 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Oracle CSPU Aug 2026, GitHub Advisory).

The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the Helidon Imperative Web Server fails to properly restrict or validate access to certain resources when processing HTTP/2 requests (GitHub Advisory). An unauthenticated attacker with network access can send specially crafted HTTP/2 requests that trigger a hang or repeatable crash in the server process. No authentication, user interaction, or elevated privileges are required, and the attack complexity is low, making it easily automatable according to CISA's SSVC assessment (Oracle CSPU Aug 2026). No public proof-of-concept code or detailed technical write-up has been identified at this time.

Successful exploitation results in a complete denial of service (DoS) of the affected Helidon server — either a persistent hang or a frequently repeatable crash — rendering the service unavailable to legitimate users. The impact is limited to availability; there is no confidentiality or integrity impact, meaning attackers cannot access or modify data through this vulnerability. Services and applications built on Helidon 4.5.1's Imperative Web Server would be directly affected, potentially disrupting dependent microservices or APIs in production environments (Oracle CSPU Aug 2026, GitHub Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). CISA's SSVC assessment classifies the vulnerability as "automatable: yes" with "exploitation: none" as of August 19, 2026, indicating that while the attack can be scripted, no active exploitation has been observed. The EPSS score is approximately 0.32%, placing it in the 24th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Oracle has released a patch for this vulnerability as part of the August 2026 Critical Security Patch Update; users should upgrade Helidon to a version beyond 4.5.1 as directed by the advisory (Oracle CSPU Aug 2026). As a temporary workaround where immediate patching is not feasible, Oracle recommends blocking the network protocols required for the attack — in this case, restricting inbound HTTP/2 traffic at the network perimeter or firewall level. Oracle strongly advises against relying on network-level controls as a long-term solution, as they do not address the underlying vulnerability (Oracle CSPU Aug 2026).