CVE-2026-46843: Oracle REST Data Services DoS Vulnerability—Patch Guidance

Technical summary

CVE-2026-46843 is an unimplemented resource management flaw (CWE-400) in Oracle REST Data Services Core. The vulnerability has a network attack vector, low complexity, and requires no authentication or user interaction. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects its narrow impact scope: availability degradation only, with no confidentiality or integrity breach. Affected versions span from 24.2.0 to 26.1.0 inclusive.

Business impact

Organizations running Oracle REST Data Services in this version range face partial service disruption risk. REST Data Services often forms a critical bridge between databases and application architectures; availability loss can cascade to dependent applications and APIs. While the impact is partial rather than complete, even intermittent unavailability of API services can disrupt customer-facing functionality and internal processes. The ease of exploitation—requiring no authentication—means any attacker on the network can trigger degradation without valid credentials.

Affected systems

Oracle REST Data Services versions 24.2.0, 24.3.0, 24.4.0, 25.x, and 26.0.0–26.1.0 are impacted. Verify your deployment version immediately; versions outside this range are unaffected. REST Data Services deployed on-premises, in hybrid environments, or in Oracle Cloud are all in scope if running a vulnerable version.

Exploitability

Exploitation is straightforward: the vulnerability is easily exploitable per the CVE description, requires no authentication, no user interaction, and can be triggered remotely via HTTPS. An attacker needs only network-level access to the REST Data Services endpoint. This low barrier to entry makes proactive patching essential, as exploitation does not require sophistication or valid credentials.

Remediation

Apply vendor patches to move to a version later than 26.1.0. Contact Oracle for the specific patched version and download guidance. Implement network segmentation to restrict HTTPS access to REST Data Services endpoints to trusted sources only. Monitor for unusual connection patterns or resource exhaustion targeting these endpoints. Verify patch application and test in a non-production environment first to confirm compatibility with your application stack.

Patch guidance

Consult Oracle's security advisories and patch repositories for versions beyond 26.1.0 that address CVE-2026-46843. Apply patches in a staged approach: test in development or staging environments first, validate REST Data Services functionality and dependent application behavior, then roll out to production. Given the ease of exploitation, prioritize this within your patching schedule. Verify the patched version's compatibility with any custom REST endpoints or configurations in your environment.

Detection guidance

Monitor REST Data Services logs for unusual patterns: repeated connection attempts to service endpoints without valid requests, rapid connection cycling, or resource consumption spikes attributable to a single source. Network intrusion detection systems should flag traffic attempting to trigger resource exhaustion against REST Data Services HTTPS endpoints. Establish baseline performance metrics for REST Data Services availability and alert on significant deviations. Check running version identifiers in REST Data Services administrative panels or logs to confirm whether your deployment is within the affected range.

Why prioritize this

This vulnerability warrants prompt remediation despite its MEDIUM severity rating. The lack of authentication requirement, ease of exploitation, and network accessibility create a low friction attack surface. While impact is limited to partial availability (not data breach), the simplicity of triggering a denial of service makes this a recurring nuisance if left unpatched. Organizations should address this in the near term—particularly those with availability SLAs or customer-facing REST APIs dependent on these services.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects the combination of high exploitability (network attack vector, low complexity, no authentication) and narrow impact scope (availability only; confidentiality and integrity unaffected). The score does not include threat actor activity or real-world exploit prevalence. Because this vulnerability has not been added to the CISA Known Exploited Vulnerabilities list, there is currently no public evidence of active exploitation, but the ease of exploitation warrants vigilance.

Frequently asked questions