CVE-2026-83330: High severity Oracle Oracle Fusion Middleware Helidon (WebSocket) vulnerability

Q: Who is exposed to this vulnerability?

Helidon deployments using the WebSocket component in supported versions 4.0.0 through 4.5.4 are affected. An attacker only needs network access over HTTP; no authentication or user interaction is required.

Q: What is the likely impact of successful exploitation?

Successful exploitation can allow an attacker to cause Helidon to hang or crash repeatedly, resulting in a complete denial of service. The provided CVSS vector indicates no stated confidentiality or integrity impact.

Published Sep 15, 2026

Updated

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Affected Software

2 affected components

Oracle Oracle Fusion Middleware Helidon (WebSocket)>=4.0.0<=4.5.4

Oracle Helidon>=4.0.0<=4.5.4

Event History

Sep 15, 2026

CVE Published

via MITRE·08:05 PM

Data Sourced

via MITRE·08:05 PM

DescriptionSeverity

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this vulnerability?

Helidon deployments using the WebSocket component in supported versions 4.0.0 through 4.5.4 are affected. An attacker only needs network access over HTTP; no authentication or user interaction is required.

What is the likely impact of successful exploitation?