CVE-2026-87289
published 2026-09-15CVE-2026-87289: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content). Supported versions that are affected are…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.47%
39.7th percentile
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | helidon | 4.0.0 – 4.5.4 | — |
| oracle_corporation | helidon | 4.0.0 – 4.5.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Oracle Helidon up to 4.5.4 helidon-webserver-static-content resource consumption
vuldb·2026-09-16·CVSS 7.5
CVE-2026-87289 [HIGH] Oracle Helidon up to 4.5.4 helidon-webserver-static-content resource consumption
A vulnerability categorized as problematic has been discovered in Oracle Helidon up to 4.5.4. This affects an unknown function of the component helidon-webserver-static-content. The manipulation results in resource consumption.
This vulnerability is identified as CVE-2026-87289. The attack can be executed remotely. There is not any exploit available.
GHSA
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content).
ghsa_unreviewed·2026-09-15
CVE-2026-87289 [HIGH] CWE-400 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content).
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-15
Published