The flaw resides in the Database Actions component of Oracle REST Data Services and permits an attacker with high privileges and network access over HTTP to impact the availability of the service. An exploited instance can experience a partial denial of service, disrupting the ability of legitimate users to interact with the REST endpoints. The vulnerability does not expose data or provide code execution; its primary impact is on system availability.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected.

The CVSS v3.1 score of 2.7 indicates a low severity, with the vector showing a local privilege requirement, no user interaction, and a user‑level availability impact. The EPSS score of 0.00368 indicates very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation knowledge. The attack is feasible over the network via standard HTTP, requiring that the attacker already possesses high‑privileged accounts within the REST interface. Given the availability focus, the risk is primarily localized to service interruption rather than data compromise.