CVE-2026-46829: Oracle REST Data Services Unauthenticated Denial of Service

CVE-2026-46829 describes a vulnerability within the Mongoapi component of Oracle REST Data Services (ORDS). The vulnerability affects versions 24.2.0 through 26.1.0. This easily exploitable flaw allows an unauthenticated attacker with network access via HTTPS to compromise an ORDS instance, resulting in a complete denial-of-service condition. Successful exploitation leads to a hang or frequent repeatable crash of the ORDS service, impacting availability. This vulnerability poses a risk to organizations relying on ORDS for RESTful access to Oracle databases, potentially disrupting critical applications and services.

Attack Chain

1. The attacker identifies a vulnerable Oracle REST Data Services instance exposed over HTTPS.
2. The attacker crafts a malicious HTTPS request targeting the Mongoapi component.
3. The crafted request exploits a flaw in the Mongoapi component related to handling of requests.
4. The vulnerable code path within Mongoapi is triggered by the malicious request.
5. The exploited code path leads to excessive resource consumption within the ORDS process.
6. The excessive resource consumption causes the ORDS service to become unresponsive.
7. The ORDS service either hangs indefinitely or crashes repeatedly.
8. Legitimate users are unable to access data and services provided by the ORDS instance, resulting in a denial of service.

Impact

Successful exploitation of CVE-2026-46829 results in a complete denial of service. This means that the Oracle REST Data Services instance becomes unavailable, disrupting any applications or services that rely on it. The vulnerability allows unauthenticated remote attackers to crash the service, causing downtime and potential data access issues. The severity of the impact will depend on the criticality of the affected ORDS instance.

Recommendation

• Apply the latest patch or upgrade to a non-vulnerable version of Oracle REST Data Services to remediate CVE-2026-46829.
• Monitor network traffic for suspicious HTTPS requests targeting the Mongoapi component of Oracle REST Data Services using the “Detect CVE-2026-46829 Exploitation Attempt” Sigma rule.
• Implement rate limiting on the ORDS instance to mitigate potential denial-of-service attacks.
• Review access controls and network segmentation to limit exposure of Oracle REST Data Services instances.