This vulnerability affects Oracle Net Services in Oracle Database Server versions 21.3-21.23 and 23.4.0-23.26.3. An unauthenticated attacker with network access can exploit this flaw to cause Oracle Net Services to hang or crash repeatedly, resulting in a complete denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact. Oracle has published a Critical Security Patch Update advisory recommending customers apply security patches promptly to mitigate such vulnerabilities. The advisory emphasizes that patches are available and should be applied without delay to prevent exploitation.

Successful exploitation results in a denial of service condition by causing Oracle Net Services to hang or crash repeatedly. There is no impact on confidentiality or integrity, but availability is severely affected, potentially disrupting database connectivity and operations.

Oracle has released security patches addressing this vulnerability as part of their September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this issue. Oracle recommends remaining on actively supported versions and not delaying patch application. No alternative mitigations or workarounds are specified in the advisory.