{"id":"CVE-2026-87393","kind":"vulnerability","aliases":["CVE-2026-87393"],"related":[],"title":"Oracle Outside In: crafted file input can crash the document parser","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).","summary":"Oracle Outside In Technology 8.5.8 has a flaw that lets an unauthenticated network attacker send content over HTTP that hangs or repeatedly crashes the library. The impact is denial of service, with no data read or code run according to the sources.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-middleware","oracle","outside-in","package","self-hosted"],"not_affected_if":["no-outside-in-usage"],"how_to_check":"- Check whether the application bundles or links Oracle Outside In Technology 8.5.8 (unknown for other versions)\n- Look for the Outside In library in the deployed Oracle Fusion Middleware installation","fix":"- unknown","status":"open","published_at":"2026-10-20T22:20:17+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:51:10+00:00","updated_at":"2026-10-25T03:51:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:51:10Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Oracle Outside In: crafted file input can crash the document parser","impact":"low","summary":"Oracle Outside In Technology 8.5.8 has a flaw that lets an unauthenticated network attacker send content over HTTP that hangs or repeatedly crashes the library. The impact is denial of service, with no data read or code run according to the sources.","category":"package","nicknames":[],"who_cares":["oracle","fusion-middleware","outside-in","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Service hangs or crashes repeatedly on crafted input, causing denial of service","analyst_note":"Find the Oracle Critical Patch Update advisory or patch for Outside In 8.5.8 and confirm the fixed version and which Fusion Middleware products carry the library.","how_to_check":"- Check whether the application bundles or links Oracle Outside In Technology 8.5.8 (unknown for other versions)\n- Look for the Outside In library in the deployed Oracle Fusion Middleware installation","needs_analyst":true,"not_affected_if":["no-outside-in-usage"],"who_is_affected":"Teams that run Oracle Fusion Middleware products embedding Outside In Technology 8.5.8 and accept HTTP uploads or content that is parsed with it. The sources do not name the exact products or configurations that expose it, so exposure beyond the listed version is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3492,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-87393':14A,17A '/av':160C '3.1':150C,159C '6.5':153C '8.5.8':33B,94C 'abil':133C 'access':103C 'accord':67B 'affect':92C 'allow':98C 'attack':42B,100C,113C,123C,125C 'avail':154C 'base':151C 'caus':135C 'code':65B 'complet':142C 'compon':83C 'compromis':107C 'content':44B 'core':86C 'craft':4A 'crash':8A,51B,141C 'cve':12A,15A 'cvss':149C,156C,158C 'data':62B 'denial':57B 'document':10A 'dos':143C 'easili':95C 'exploit':96C 'file':5A 'flaw':36B 'frequent':139C 'fusion':19B,81C 'fusion-middlewar':18B 'h':168C 'hang':48B,137C 'host':28B 'http':46B,105C 'human':115C 'impact':55B,155C 'input':6A 'interact':116C 'l/pr':162C 'let':38B 'librari':53B 'middlewar':20B,82C 'n/a':167C 'n/ac':161C 'n/i':166C 'n/ui':163C 'network':41B,102C 'oracl':1A,21B,29B,74C,80C,108C,145C 'outsid':2A,23B,30B,75C,84C,109C,146C 'outside-in':22B 'packag':25B 'parser':11A 'person':119C 'product':78C 'r/s':164C 'read':63B 'repeat':50B,140C 'requir':114C 'result':130C 'run':66B 'score':152C 'self':27B 'self-host':26B 'send':43B 'servic':59B 'sourc':70B 'success':112C,124C 'support':88C 'technolog':32B,77C,111C,148C 'u/c':165C 'unauthent':40B,99C 'unauthor':132C 'vector':157C 'version':89C 'via':104C 'vulner':71C,97C,128C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Oracle Fusion Middleware products embedding Outside In Technology 8.5.8 and accept HTTP uploads or content that is parsed with it. The sources do not name the exact products or configurations that expose it, so exposure beyond the listed version is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87393","severity":null,"published_at":"2026-10-20T22:20:17+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}