Because of several critical CVEs (such as CVE-2026-46840 and CVE-2026-46839) we upgraded ORDS from 24.2.3 to 26.1.2 but this broke external access to the APEX application (which are running on APEX 24.2.10). We have a WAF that acts as a proxy server to proxy requests to our backend services. We are running Tomcat on a Virtual Machine where several web applications are deployed on such as ORDS.
Our internal URLs are working fine but when trying to reach the external url, ORDS is loading partially as we can see requests passing through the WAF and sending it to ORDS, however it is stuck at loading these two endpoints:
apex/wwv_flow.js_messages?p_app_id=1110000&p_lang=nl&p_version=26.1.0-4943106744&p_nls_settings=eyJudW1lcmljQ2hhcmFjdGVycyI6Ii4sIiwiY3VycmVuY3kiOiIkIiwiaXNvQ3VycmVuY3kiOiJBTUVSSUNBIiwiZHVhbEN1cnJlbmN5IjoiJCJ9
/apex/wwv_flow.js_dialogs?p_app_id=1110000&p_version=26.1.0-4943106744
What we have tried so far:
- Upgrading APEX to 26.1 (perhaps due to compatibility issues)
- Added the forwarded headers to security.httpsHeaderCheck (X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Host)
- Added the external domain to security.externalSessionTrustedOrigins
- Restarted the proxy server
I am out of options and would really like to have it solved ASAP. Has anyone encountered this issue as well? Could it be that ORDS has more restricted requirements for running it behind a proxy server? I could not find anything related to this in the release notes.
Rollbacking is unfortunately not an option due to the severities of those CVEs.
NOTE: It is not the WAF (as we initially thought because a rollback to ORDS 24.2.3 made the environment work again)