CVE-2026-46835: 
Oracle Database Server vulnerability analysis and mitigation

CVE-2026-46835 is a Denial of Service vulnerability in the Net Service component of Oracle Database Server, classified under CWE-400 (Uncontrolled Resource Consumption). It affects supported versions 23.4.0 through 23.26.2 and was disclosed on May 28, 2026, as part of Oracle's May 2026 Critical Security Patch Update (CSPU). An unauthenticated attacker with network access via TLS can exploit this vulnerability to cause a hang or frequently repeatable crash of the Net Service component. It carries a CVSS v3.1 base score of 7.5 (High) (Oracle CSPU May 2026, GitHub Advisory).

The root cause is Uncontrolled Resource Consumption (CWE-400) in Oracle Database Server's Net Service component, which handles TLS-based network communications. An unauthenticated remote attacker can send specially crafted TLS requests that cause the Net Service to exhaust resources, resulting in a hang or crash. No authentication, user interaction, or elevated privileges are required, and the attack complexity is low, making it straightforward to trigger. The vulnerability is applicable to all 23.x Oracle Homes including Database, Grid, and Client installations; notably, databases running earlier versions are also vulnerable if operating under a 23.x Grid that has not been patched (Oracle CSPU May 2026).

Successful exploitation results in a complete Denial of Service (DoS) of the Oracle Database Net Service component — the primary network listener and communication layer for Oracle Database. An unauthenticated attacker can repeatedly crash or hang this service, rendering the database inaccessible to legitimate clients and applications. There is no confidentiality or integrity impact; the vulnerability is purely an availability risk. However, sustained exploitation could cause significant operational disruption in environments relying on Oracle Database 23.x for critical workloads (Oracle CSPU May 2026, GitHub Advisory).

• Network: Unusual or high-volume TLS connection attempts to Oracle Net Service listener ports (default TCP 1521) from unexpected or external sources.
• Logs: Oracle listener log (listener.log) showing repeated connection failures, timeouts, or abnormal termination events; Oracle alert log entries indicating Net Service crashes or restarts.
• Process: Unexpected termination or restart of the Oracle TNS listener process (tnslsnr); elevated CPU or memory usage by the listener process prior to crash.
• Availability: Repeated, unexplained database connectivity outages or service unavailability reported by application teams without corresponding infrastructure events.

Oracle has released patches for CVE-2026-46835 as part of the May 2026 Critical Security Patch Update. Patches must be applied to all 23.x Oracle Homes, including Database, Grid, and Client installations. As a temporary workaround prior to patching, Oracle recommends restricting network access to the Net Service component (e.g., TCP port 1521) to trusted sources only using network-level controls such as firewalls or access control lists. Oracle strongly advises against treating network blocking as a long-term solution, as it does not address the underlying vulnerability (Oracle CSPU May 2026).

The May 2026 Oracle CSPU, which includes CVE-2026-46835, received coverage from security news outlets including CyberSecurityNews and CyberNoz, which highlighted Oracle's release of patches for 35 vulnerabilities across multiple product families. No specific researcher commentary or notable social media discussion focused exclusively on CVE-2026-46835 has been identified, likely due to the absence of a public exploit and its purely availability-focused impact. The broader CSPU release was noted for including higher-severity vulnerabilities such as CVE-2026-46840 (CVSS 10.0) in Oracle REST Data Services, which drew more attention.