CVE-2026-87289

Executive Summary

CVE-2026-87289 is an unauthenticated, remotely exploitable denial-of-service vulnerability in Oracle Helidon, specifically within the helidon-webserver-static-content component, affecting versions 4.0.0 through 4.5.4. Any internet- or network-exposed Helidon webserver serving static content is at risk, and a successful attack allows a remote attacker to cause a hang or a frequently repeatable crash (complete denial of service) of the affected service. With a CVSS 3.1 base score of 7.5 and no public PoC, patch, or KEV listing currently available, this vulnerability represents a persistent availability risk that requires immediate configuration-based mitigation.

Technical Analysis

CVE-2026-87289 is classified under CWE-400, Uncontrolled Resource Consumption. The NVD description attributes the flaw to the static content serving subsystem of Helidon (helidon-webserver-static-content), which is the module responsible for reading and returning static assets (HTML, CSS, JavaScript, images) to HTTP clients.

The vulnerability is reachable over the network via HTTP by an unauthenticated attacker (CVSS vector AV:N/AC:L/PR:N/UI:N). The complexity is rated Low and no privileges or user interaction are required, indicating that the trigger condition is straightforward once the vulnerable endpoint or request pattern is identified. The impact is confined to availability (C:N/I:N/A:H) — there is no confidentiality or integrity impact per the CVSS vector.

The core mechanism, per the description, is a denial-of-service condition that manifests as a hang or a frequently repeatable crash of the Helidon process. In CWE-400 terms, this typically means the attacker can submit requests that cause the static content handler to consume an unbounded or disproportionate amount of a finite resource — such as heap memory, thread pool capacity, file descriptors, or event-loop capacity — until the webserver becomes unresponsive or terminates. The description does not enumerate the precise request parameters, header values, or file paths that trigger the condition.

The NVD description does not provide:

• The specific request vector (path, query string, header, or request body construction) that triggers the resource exhaustion.
• The exact resource that is exhausted (memory, threads, file handles, etc.).
• Whether the flaw is a partial-read loop, a decompression/encoding amplification, a connection-handling leak, or a caching defect.

No public proof-of-concept, exploit code, or Nuclei template has been observed for this CVE. Any claims of specific trigger payloads circulating in the wild should be treated as unverified until corroborated by Oracle or Helidon maintainers. Analysts should be aware that the helidon-webserver-static-content component is a first-party Oracle module and that the affected range (4.0.0–4.5.4) aligns with the Helidon 4.x release train.

Exploitation Scenarios

Because no public PoC exists, the following attack chain is described at the vulnerability-class level only. No specific endpoint, header name, or payload syntax is asserted beyond what the NVD description states.

1. Reconnaissance / Target Identification. An attacker enumerates network-accessible services and identifies Helidon-based webservers (see Shodan dorks in METADATA). Since the affected component is helidon-webserver-static-content, candidate targets are those serving static assets. Version fingerprinting to confirm a version in the 4.0.0–4.5.4 range increases confidence, but the flaw is exploitable without authentication regardless.

2. Trigger of the Flaw Class (Uncontrolled Resource Consumption). The attacker sends HTTP requests crafted to drive the static content handler into disproportionate resource consumption. Per CWE-400 and the NVD description, the objective is to exhaust a finite resource (for example, heap, worker threads, or open file descriptors) associated with serving static content. Because AC:L and PR:N apply, the request structure required is not complex — repeated or specifically shaped HTTP requests are sufficient to trigger the condition. No user interaction and no valid credentials are needed.

3. Execution Method. Execution is purely remote over the network via HTTP. The attacker does not deliver a code payload; the vulnerability is triggered by abusive request patterns rather than malicious code. At this stage, the attacker iterates requests until the target exhibits degradation (latency increase, failed responses) and then escalates to full unavailability.

4. Post-Exploitation Impact. Per the description, the outcome is a hang or frequently repeatable crash — a complete denial of service. The attacker can repeat the trigger to maintain the outage, denying legitimate users access to the application and any co-hosted static assets. There is no stated data exfiltration or data modification impact (C:N/I:N/A:H), so the effect is availability-centric.

Note: No public PoC is available; the attack chain above is inferred from the vulnerability class (CWE-400) and the CVSS vector. It should not be read as a validated exploit recipe.

Impact Assessment

Severity: High (CVSS 3.1 Base 7.5). The entire score derives from availability impact; confidentiality and integrity are rated None.

CVSS Subscore Interpretation:

• AV:N (Network): Remotely exploitable across the internet or any routed network — widens the blast radius significantly.
• AC:L (Low): No special conditions or race windows required, lowering the skill barrier for attackers.
• PR:N (None): No credentials required; fully unauthenticated attack surface.
• UI:N (None): No victim user interaction needed — self-contained remote trigger.
• S:U (Unchanged): Impact remains within the vulnerable Helidon component; no stated cross-boundary escalation.
• C:N / I:N: No data exposure or tampering per the vector.
• A:H (High): Total loss of availability — full hang or repeatable crash.

Business Impact: Any Helidon 4.0.0–4.5.4 deployment serving static content becomes a candidate for service outage. Because the attack is unauthenticated and low-complexity, it is well suited to denial-of-service campaigns, including botnet-driven flooding. Repeated triggering ("frequently repeatable crash") implies the adversary can sustain the outage, complicating recovery. Enterprises hosting customer-facing applications on Helidon, as well as internal-only deployments reachable through compromised network segments, are in scope.

Blast Radius: Determined by how many Helidon instances serve static content and how they are load-balanced. A single instance crash may be masked by redundancy; however, a coordinated flood against all replicas can take down the entire service tier. Microservices architectures where Helidon fronts static assets (SPA bundles, dashboards) could see ripple effects across dependent services.

Detection Guidance

Sigma Rule

title: Potential Helidon Static Content DoS - CVE-2026-87289 Resource Exhaustion
id: 4f3a9c21-8728-4b10-a6d2-helidon87289
status: experimental
description: Detects anomalous volumes of HTTP requests to a Helidon webserver serving static content, consistent with resource-exhaustion exploitation of CVE-2026-87289 (CWE-400).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87289
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1499
logsource:
  category: webserver
  product: helidon
detection:
  selection_status:
    sc-status:
      - 503
      - 500
      - 502
  selection_volume:
    # High request rate toward static content endpoints
    cs-uri-stem|endswith:
      - '.html'
      - '.css'
      - '.js'
      - '.png'
      - '.jpg'
  timeframe: 1m
  condition: selection_status and selection_volume | count(cs-uri-stem) by src_ip > 300
falsepositives:
  - Legitimate bulk asset fetching by CDN pre-fetch or monitoring probes
  - Load testing or synthetic monitoring
level: medium

YARA Rule

rule CVE_2026_87289_Helidon_StaticContent_DoS
{
    meta:
        description = "Detects repeated HTTP request patterns targeting Helidon static content that may indicate CVE-2026-87289 resource exhaustion (CWE-400)."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87289"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "GET /" ascii nocase
        $s2 = "HTTP/1.1" ascii
        $ext_html = ".html" ascii nocase
        $ext_css  = ".css"  ascii nocase
        $ext_js   = ".js"   ascii nocase
        $helidon  = "Helidon" ascii nocase

    condition:
        (
            $s1 and $s2 and
            ( $ext_html or $ext_css or $ext_js )
        )
        or
        ($helidon and $s2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87289 Helidon Static Content DoS Resource Exhaustion Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:".html"; nocase; threshold: type both, track by_src, count 200, seconds 60; classtype:attempted-dos; reference:cve,2026-87289; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87289; metadata:affected_product Helidon; sid:8728901; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where event.action == "network" and destination.port in (80, 443, 8080, 8443)
    and http.request.method == "GET" ]
  [ network where event.action == "network"
    and http.response.status_code in (500, 502, 503, 504) ]

Splunk SPL Query

index=web sourcetype=helidon_access
| where match(cs_uri_stem, "\.(html|css|js|png|jpg|gif)$")
| bin _time span=1m
| stats count as req_count, dc(cs_uri_stem) as distinct_paths, values(sc_status) as status_codes by _time, src_ip
| where req_count > 300
| table _time, src_ip, req_count, distinct_paths, status_codes

Wazuh OSSEC Rule

<group name="web,helidon,attack,">
  <rule id="100872" level="10">
    <if_sid>31100</if_sid>
    <match>helidon</match>
    <regex>\.(html|css|js) "GET</regex>
    <description>CVE-2026-87289: Possible Helidon static content resource-exhaustion DoS attempt detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence has been identified from any tracked source. No vendor fix, workaround, or affected version metadata beyond the NVD description is currently available.

1) Immediate Mitigations (prioritize):

• Limit network exposure of Helidon-based applications. Restrict access via firewall, security groups, or reverse-proxy ACLs to known trusted clients where the app is not intended for public use.
• Deploy a reverse proxy / WAF (e.g., with rate-limiting) in front of Helidon and enforce per-IP request throttling and connection limits on static asset paths.
• Configure application-level rate limiting and request-size limits in the Helidon configuration surface, following Oracle's general Helidon security guidelines until a specific advisory is published.
• Enable redundant replicas behind a load balancer with health-check-based failover so a single crash does not cause a full outage, and monitor the Helidon instance health closely.
• Turn on verbose webserver and JVM resource telemetry (heap, thread count, file descriptors) to detect early-stage resource exhaustion.

2) Patch / Upgrade Steps:

• No patch is available as of this report's data. Monitor Oracle's Critical Patch Update (CPU) channel and the Oracle Helidon release notes for a fix addressing CVE-2026-87289.
• Monitor the NVD entry (linked below) for reference entries, and the Helidon GitHub project for commits or releases specifically mentioning the static content component.
• Plan for an expedited patch cycle once a fixed version is announced. Because the affected range is 4.0.0–4.5.4, expect the fix in a 4.5.x point release or later; do not upgrade prematurely without vendor confirmation of the fixing version.

3) Long-Term Hardening:

• Maintain an inventory of all Helidon deployments and their versions, with automatic notifications on version drift.
• Adopt a defense-in-depth posture: rate-limiting at the edge, resource caps at the runtime (JVM -Xmx, thread pool bounds, ulimit file descriptors), and graceful degradation behavior.
• Integrate application dependency scanning that flags known Helidon CVEs in the 4.x line.
• Exercise incident response playbooks for availability-focused DoS incidents, including failover and forensic capture of trigger traffic for later root-cause analysis.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-87289
2. Oracle Critical Patch Updates (CPU) Advisory Hub — https://www.oracle.com/security-alerts/
3. Helidon Project / Oracle Fusion Middleware Product Documentation (static content webserver component) — https://helidon.io/
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
5. CWE-400 — Uncontrolled Resource Consumption — https://cwe.mitre.org/data/definitions/400.html

Exploit-in-the-Wild / Threat Actor Evidence: None currently identified. CISA KEV: NO. No public PoC, exploit code, or Nuclei template is associated with this CVE per available data. No known threat actor campaigns have been attributed to CVE-2026-87289 at the time of writing. Because EPSS has not been scored by FIRST.org for this CVE, no exploitation-likelihood estimate is available and none is fabricated here.

Report generated by valtersit.com Threat Intelligence. All technical claims are derived strictly from the NVD description and associated metadata provided. No implementation-specific details have been fabricated; where the source data is sparse, the vulnerability class is described generically.