A flaw in Oracle Outside In Technology, part of Oracle Fusion Middleware, allows an unauthenticated attacker who can reach the system over HTTP to cause the application to hang or crash repeatedly. The vulnerability is an instance of a Resource Exhaustion weakness (CWE‑400). It is easily exploitable and does not require any credentials, leading to a complete denial of service. The weakness results from inadequate handling of certain requests that can overwhelm the system’s resources or trigger fatal errors, producing an unavailable service until the component is restarted or the system is otherwise recovered.

Oracle Corporation’s Outside In Technology product, specifically version 8.5.8 of the Outside In Clean Content SDK, is the only affected release identified. No other vendors or product variants are listed.

The CVSS 3.1 base score of 7.5 indicates a moderate severity under availability impact with low effort and no required privileges. The EPSS score is not available, and the vulnerability is not catalogued in CISA KEV, but the description notes it is easily exploitable by any network‑accessible client. The likely attack vector is remote, network‑based HTTP traffic; an attacker can send crafted requests to trigger the crash or hang, and no authentication or privileged access is needed. The impact is a full service outage that can be repeated indefinitely until remediation.