{"id":"CVE-2026-87398","kind":"vulnerability","aliases":["CVE-2026-87398"],"related":[],"title":"Oracle Outside In: unauthenticated network request crashes or hangs the library","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","summary":"Oracle Outside In Technology, a file-parsing library in Oracle Fusion Middleware, has a flaw that an unauthenticated remote attacker can trigger over HTTP. The result is a repeatable hang or crash that denies service to the application using it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-middleware","java","oracle","outside-in","package","self-hosted"],"not_affected_if":["no-oracle-fusion-middleware"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T22:20:18+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:18:45+00:00","updated_at":"2026-10-25T03:18:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:18:45Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Oracle Outside In: unauthenticated network request crashes or hangs the library","impact":"low","summary":"Oracle Outside In Technology, a file-parsing library in Oracle Fusion Middleware, has a flaw that an unauthenticated remote attacker can trigger over HTTP. The result is a repeatable hang or crash that denies service to the application using it.","category":"package","nicknames":[],"who_cares":["oracle","fusion-middleware","outside-in","java","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Repeatable crash or hang causes complete denial of service for the library","analyst_note":"Find Oracle's advisory (Critical Patch Update) for the fixed Outside In Core version and the list of affected Fusion Middleware products at https://nvd.nist.gov/vuln/detail/CVE-2026-87398.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-oracle-fusion-middleware"],"who_is_affected":"Teams running Oracle Fusion Middleware products that embed Oracle Outside In Core version 8.5.8, where HTTP-reachable file parsing passes untrusted content to the library. Sources do not name the exact products or deployment paths. Teams that do not run Oracle Fusion Middleware with Outside In can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000607,"input_tokens":3470,"output_tokens":519,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-87398':14A,17A '/av':147C '3.1':137C,146C '7.5':140C '8.5.8':93C 'abil':120C 'access':102C 'affect':91C 'allow':97C 'applic':68B 'attack':50B,99C,112C 'avail':141C 'base':138C 'caus':122C 'complet':129C 'compon':82C 'compromis':106C 'core':85C 'crash':7A,62B,128C 'cve':12A,15A 'cvss':136C,143C,145C 'deni':64B 'dos':130C 'easili':94C 'exploit':95C 'file':36B 'file-pars':35B 'flaw':45B 'frequent':126C 'fusion':19B,41B,80C 'fusion-middlewar':18B 'h':155C 'hang':9A,60B,124C 'host':29B 'http':54B,104C 'impact':142C 'java':21B 'l/pr':149C 'librari':11A,38B 'middlewar':20B,42B,81C 'n/a':154C 'n/ac':148C 'n/i':153C 'n/s':151C 'n/ui':150C 'network':5A,101C 'oracl':1A,22B,30B,40B,73C,79C,107C,132C 'outsid':2A,24B,31B,74C,83C,108C,133C 'outside-in':23B 'packag':26B 'pars':37B 'product':77C 'remot':49B 'repeat':59B,127C 'request':6A 'result':56B,117C 'score':139C 'self':28B 'self-host':27B 'servic':65B 'success':111C 'support':87C 'technolog':33B,76C,110C,135C 'trigger':52B 'u/c':152C 'unauthent':4A,48B,98C 'unauthor':119C 'use':69B 'vector':144C 'version':88C 'via':103C 'vulner':70C,96C,115C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Fusion Middleware products that embed Oracle Outside In Core version 8.5.8, where HTTP-reachable file parsing passes untrusted content to the library. Sources do not name the exact products or deployment paths. Teams that do not run Oracle Fusion Middleware with Outside In can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87398","severity":null,"published_at":"2026-10-20T22:20:18+00:00","modified_at":"2026-10-22T19:18:03+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}