EUVD-2026-106436
GHSA-gvg7-w3f2-4xhr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HTTP-exposed Outside In service
-
ExploitSubmit crafted malformed document
-
ExecutionTrigger parser hang/crash in Outside In Core
-
ImpactService denial of service (complete DOS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application that embeds Oracle Outside In Technology 8.5.8 (Outside In Core) and exposes its document/file-parsing functionality to attacker-supplied input reachable over HTTP; the attacker must be able to deliver a crafted malformed file for Outside In to process. Per CVSS PR:N/UI:N, no authentication or user interaction is needed. Limiting factors: exploitation depends on Outside In actually ingesting untrusted content (deployments that process only trusted/internal documents are not practically exposed), and impact is confined to availability - a service hang or repeatable crash - with no data access or code execution. |
| Impact | This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity, unauthenticated flaw - attractive to attackers - but the impact is strictly availability (C:N/I:N), yielding a complete denial of service (hang or repeatable crash) rather than code execution or data compromise. The 7.5 score is driven entirely by A:H; there is no confidentiality or integrity dimension. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no confirmed-exploitation signal to elevate priority; this is 'no public exploit identified at time of analysis.' A caveat on the attack vector: Oracle Outside In Technology is a document-parsing/file-conversion SDK, so real-world triggering typically requires the target application to process attacker-supplied content - Oracle's AV:N/HTTP framing reflects products that accept such content over HTTP, but in deployments where Outside In parses only local or trusted files the practical attack surface is narrower. Net: a real, patch-worthy DoS issue, but not a CVSS-inflated emergency - prioritize behind any RCE/data-exposure items and in proportion to internet-facing exposure. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a specially crafted document (e.g., an office, image, or archive file) to an internet-facing application that embeds Oracle Outside In Technology 8.5.8 for content conversion or preview. When Outside In Core parses the malformed file, it hangs or repeatably crashes, taking down the document-processing service (complete DoS). No public exploit code is identified in the supplied data, and the attack requires no authentication or user interaction per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote attackers can hang or repeatedly crash services that embed Oracle Outside In Technology 8.5.8 (Outside In Core) by delivering a crafted malformed document to its file-parsing engine, producing a CVSS 7.5 availability-only denial of service (AV:N/AC:L/PR:N/UI:N/A:H, no confidentiality or integrity impact). Because Outside In is a parsing SDK rather than a network service, real exposure is limited to applications that expose its document-conversion/filtering functionality to attacker-supplied files over HTTP; deployments that only process trusted internal documents are not practically reachable. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the feed data, so the practical risk is bounded to availability disruption of document-processing pipelines.
RemediationAI
Apply the Outside In Technology fix shipped in the October 2026 Oracle Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); the supplied data names 8.5.8 as the affected release but does not publish a fixed version string, so confirm the replacement bundle version with Oracle Support/OTN and then rebuild and redeploy the consuming application, since an SDK update only takes effect once the embedding product is relinked - plan for a full application release cycle rather than a drop-in patch. Where the update cannot be applied immediately, compensate at the embedding layer: run Outside In parsing inside an isolated, resource-capped worker process (CPU/memory/time limits) under a supervisor that kills and restarts hung or crashed workers, accepting added latency and infrastructure cost; enforce strict upload size, page-count, and nesting-depth limits and reject malformed or unusual formats before they reach the parser, which reduces but does not eliminate trigger files; rate-limit or queue document submissions per client so a repeatable crash cannot be amplified into a sustained outage; and if the application does not actually need to parse untrusted content through Outside In, disable or remove those conversion code paths entirely for untrusted input. Note that Oracle generally does not issue one-off patches for Outside In outside the CPU cycle, so version tracking against the advisory is the durable control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Outside In Technology is a set of Oracle Fusion Middleware SDKs used by third-party applications to identify, extract, convert, and index content from hundreds of file formats (PDF, Microsoft Office, archives, email containers, and others); Outside In Core is the underlying format-detection and parsing/filtering engine that does the actual content handling. The defect sits in that core parsing path: when Outside In ingests a malformed file, the parsing routine can enter a non-terminating or faulting state, causing the hosting application's worker to hang or crash reproducibly. No CWE identifier was assigned in the source data, but the behavior corresponds to improper input validation leading to resource exhaustion/uncontrolled consumption rather than memory corruption, which is consistent with the availability-only CVSS impact vector. The AV:N/PR:N/UI:N metrics describe the embedding application's HTTP-reachable upload or parse endpoint, not the SDK itself - Outside In does not listen on a port, so effective attack surface depends entirely on how the consuming product wires the library to untrusted input. The EUVD record (EUVD-2026-106436) corroborates the single affected release, 8.5.8, and no CPE bindings were published in the supplied data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-delivered crafted file crashes the parser with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Outside In Technology 8.5.8, an embedded document-parsing SDK, has an availability-only denial-of-service flaw that can hang or repeatedly crash services exposed to attacker-supplied files over HTTP. Business exposure is limited to organizations that expose Outside In-based document conversion or filtering to untrusted uploads; teams processing only trusted internal documents are unlikely to be affected. Leadership should prioritize identifying externally reachable document-processing pipelines and approving interim containment, because no vendor-released patch was identified at time of analysis and no public exploit was identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include restricting or disabling untrusted document uploads to Outside In 8.5.8 endpoints, enforcing file-type and size validation, isolating parsing in low-privilege containers with resource limits and restart controls, rate-limiting and timing out conversion requests, monitoring for crashes and hangs, and confirming that internal-only deployments receive only trusted documents.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB