CVE-2026-83349: Oracle Net Services DOS Vulnerability

CVE-2026-83349 Overview

CVE-2026-83349 is a denial-of-service vulnerability in the Oracle Net Services component of Oracle Database Server. The flaw allows an unauthenticated attacker with network access via Oracle Net to hang or repeatedly crash Oracle Net Services. Affected releases include Oracle Database Server versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. The weakness is categorized as uncontrolled resource consumption [CWE-400]. Exploitation requires no authentication and no user interaction, and it targets availability only. Oracle addressed the issue in the September 2026 Critical Patch Update.

Critical Impact
A remote, unauthenticated attacker can trigger a complete denial of service against Oracle Net Services, disrupting all database connectivity for downstream applications.

Affected Products

Oracle Database Server 19.3 through 19.32
Oracle Database Server 21.3 through 21.23
Oracle Database Server 23.4.0 through 23.26.3

Discovery Timeline

2026-09-15 - CVE-2026-83349 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83349

Vulnerability Analysis

Oracle Net Services provides the network communication layer between database clients and the Oracle Database Server instance. It handles session establishment, protocol negotiation, and data transport over the Oracle Net protocol. The vulnerability in this component allows a network-based attacker to send crafted traffic that causes Oracle Net Services to hang or crash in a frequently repeatable manner. Because the listener is the entry point for all client connectivity, a successful attack severs application access to the database. The condition maps to uncontrolled resource consumption [CWE-400], indicating the process fails to bound resources or handle malformed protocol states safely. The EPSS probability at publication was 0.46% (percentile 38.9), reflecting no observed in-the-wild exploitation to date.

Root Cause

The root cause is uncontrolled resource consumption within Oracle Net Services message handling. Oracle has not published low-level technical details, but the classification indicates the service consumes memory, CPU, or connection state without enforcing safe limits when processing attacker-supplied network input. Repeated or specially crafted requests exhaust the process or drive it into an unrecoverable state.

Attack Vector

The attack originates from the network over the Oracle Net protocol, typically TCP port 1521. No credentials or user interaction are required. An attacker with reachability to the database listener sends malicious packets to induce a hang or crash. Exploitation impacts availability only, with no disclosure or modification of database contents. See the Oracle Security Alert September 2026 for vendor guidance.

Detection Methods for CVE-2026-83349

Indicators of Compromise

Repeated unexplained crashes or restarts of the Oracle listener process (tnslsnr) recorded in listener.log or alert.log.
Sudden loss of client connectivity accompanied by ORA-12537, ORA-12547, or ORA-03113 errors across multiple applications.
Bursts of short-lived or malformed connections to TCP port 1521 from untrusted source addresses.
Abnormal memory or CPU spikes in the listener or dispatcher processes preceding a service hang.

Detection Strategies

Monitor listener.log for irregular connection patterns, protocol errors, and unexpected listener restarts.
Deploy network intrusion detection signatures for anomalous Oracle Net (TNS) traffic, including malformed handshake sequences.
Correlate database availability alerts with source IP telemetry to identify repeatable crash-inducing clients.

Monitoring Recommendations

Alert on listener process termination and automatic restart events at the operating system level.
Track connection failure rates and listener response latency as service-health KPIs.
Capture packet traces on port 1521 when anomalies occur to support post-incident analysis.

How to Mitigate CVE-2026-83349

Immediate Actions Required

Apply the Oracle September 2026 Critical Patch Update to all affected Database Server versions.
Restrict network access to the Oracle listener so only authorized application and administration hosts can reach TCP port 1521.
Inventory all Oracle Database Server instances in scope, including 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 builds.
Enable listener logging and forward events to a centralized monitoring platform for rapid identification of exploitation attempts.

Patch Information

Oracle released fixes as part of the September 2026 Critical Patch Update. Administrators should review the Oracle Security Alert September 2026 for the exact patch identifiers and installation instructions applicable to each supported release train.

Workarounds

Enforce firewall access control lists so only trusted subnets can reach the listener.
Configure Oracle Net VALID_NODE_CHECKING_REGISTRATION and TCP.INVITED_NODES to restrict permitted client addresses.
Terminate Oracle Net traffic through a hardened proxy or bastion capable of dropping malformed TNS packets.
Deploy rate limiting on port 1521 to reduce the impact of repeatable crash attempts.

bash

# Configuration example: restrict listener to trusted hosts in sqlnet.ora
tcp.validnode_checking = yes
tcp.invited_nodes = (10.0.10.15, 10.0.10.16, 10.0.20.0/24)
# Reload the listener after changes
lsnrctl reload