A flaw in the Oracle Outside In Technology product within Oracle Fusion Middleware allows an unauthenticated attacker who can reach the service over HTTP to cause the application to hang or crash. The failure results in a complete denial of service, affecting only availability while leaving confidentiality and integrity untouched. The vulnerability is a CWE-400 issue, and it is categorized as a high severity issue with a CVSS 3.1 base score of 7.5.

Oracle Outside In Technology version 8.5.8, part of Oracle Fusion Middleware, is the affected release. The component involved is the Outside In Clean Content SDK, which is exposed to HTTP traffic.

The CVSS 7.5 score indicates a high willingness to disrupt service. The EPSS score of less than 1% suggests that exploitation is uncommon, yet the vulnerability remains publicly known and can be leveraged by any remote actor with network access to HTTP without authentication or privileges. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is simple and remote, meaning that once exploited it will cause a denial of service without affecting data confidentiality or integrity.