High WID-SEC-2026-1720 11 CVEs

Oracle REST Data Services: Mehrere Schwachstellen

Published May 28, 2026 · Updated May 28, 2026 · de-DE

Vendor: Oracle Product: REST Data Services Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle REST Data Services ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle REST Data Services (ORDS) ermöglicht die Erstellung grundlegender RESTful Web Services unter Verwendung von PL/SQL.

Vulnerabilities 11

Critical 10.0

CVE-2026-46840

Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are …

Oracle Oracle REST Data Services

May 28, 2026
Critical 9.9

CVE-2026-46775

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…

Oracle Oracle REST Data Services

May 28, 2026
Critical 9.9

CVE-2026-46839

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…

Oracle Oracle REST Data Services

May 28, 2026
High 8.1

CVE-2026-35277

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…

Oracle Oracle REST Data Services

May 28, 2026
High 7.9

CVE-2026-35266

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D…

Oracle Oracle REST Data Services

May 28, 2026
High 7.5

CVE-2026-46829

Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.…

Oracle Oracle REST Data Services

May 28, 2026
High 7.4

CVE-2026-2332 Public exploit

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.htm…

Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven

Apr 14, 2026
Medium 5.3

CVE-2026-46830

Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.…

Oracle Oracle REST Data Services

May 28, 2026
Medium 5.3

CVE-2026-46841

Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.1.0…

Oracle Oracle REST Data Services

May 28, 2026
Medium 5.3

CVE-2026-46842

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…

Oracle Oracle REST Data Services

May 28, 2026
Medium 5.3

CVE-2026-46843

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…

Oracle Oracle REST Data Services

May 28, 2026

Revision history

2026-05-28 #1
Initiale Fassung

References

Oracle Critical Security Patch Update Advisory - May 2026 - Appendix Oracle REST Data Services vom 2026-05-28
https://www.oracle.com/security-alerts/cspumay2026.html#AppendixREST