cursor_sharing=similar is supposed to do this.  You must have an "unsafe" bind in there.  This is the cause.

I'll take the example from:

and stop it short - showing the multiple cursors, without any Y's:

ops$tkyte@ORA9IR2> drop table t;
 
Table dropped.
 
ops$tkyte@ORA9IR2> alter system flush shared_pool;
 
System altered.
 
ops$tkyte@ORA9IR2> create table t
  2  as
  3  select object_id, rpad('*',20,'*') data
  4    from all_objects
  5   union all
  6  select 0, rpad('*',20,'*') data
  7    from all_objects
  8  /
 
Table created.
 
ops$tkyte@ORA9IR2> create index t_idx on t(object_id);
 
Index created.
 
ops$tkyte@ORA9IR2> exec dbms_stats.gather_table_stats( user, 'T', method_opt => 'for all indexed columns size 254', cascade => true );
 
PL/SQL procedure successfully completed.
 
ops$tkyte@ORA9IR2> set autotrace traceonly explain
ops$tkyte@ORA9IR2> select * from t where object_id = 55;
 
Execution Plan
----------------------------------------------------------
   0      SELECT STATEMENT Optimizer=CHOOSE (Cost=2 Card=1 Bytes=16)
   1    0   TABLE ACCESS (BY INDEX ROWID) OF 'T' (Cost=2 Card=1 Bytes=16)
   2    1     INDEX (RANGE SCAN) OF 'T_IDX' (NON-UNIQUE) (Cost=1 Card=1)
 
 
 
ops$tkyte@ORA9IR2> select * from t where object_id = 0;
 
Execution Plan
----------------------------------------------------------
   0      SELECT STATEMENT Optimizer=CHOOSE (Cost=38 Card=27603 Bytes=441648)
   1    0   TABLE ACCESS (FULL) OF 'T' (Cost=38 Card=27603 Bytes=441648)
 
 
 
ops$tkyte@ORA9IR2> set autotrace off
ops$tkyte@ORA9IR2> alter session set cursor_sharing=similar;
 
Session altered.
 
ops$tkyte@ORA9IR2> set autotrace traceonly statistics;
ops$tkyte@ORA9IR2> select * from t where object_id= 55;
 
 
Statistics
----------------------------------------------------------
          0  recursive calls
          0  db block gets
          4  consistent gets
          0  physical reads
          0  redo size
        453  bytes sent via SQL*Net to client
        499  bytes received via SQL*Net from client
          2  SQL*Net roundtrips to/from client
          0  sorts (memory)
          0  sorts (disk)
          1  rows processed
 
ops$tkyte@ORA9IR2> select * from t where object_id= 0;
 
27822 rows selected.
 
 
Statistics
----------------------------------------------------------
          0  recursive calls
          0  db block gets
       2085  consistent gets
          0  physical reads
          0  redo size
     363945  bytes sent via SQL*Net to client
      20893  bytes received via SQL*Net from client
       1856  SQL*Net roundtrips to/from client
          0  sorts (memory)
          0  sorts (disk)
      27822  rows processed
 
ops$tkyte@ORA9IR2> set autotrace off
ops$tkyte@ORA9IR2> column sql_text format a30
ops$tkyte@ORA9IR2> column address new_val ADDR
ops$tkyte@ORA9IR2> select parsing_user_id puid, parsing_schema_id psid,
  2         sql_text, address, child_address
  3    from v$sql
  4   where sql_text like 'select * from t where object_id= %';
 
      PUID       PSID SQL_TEXT                       ADDRESS  CHILD_AD
---------- ---------- ------------------------------ -------- --------
       372        372 select * from t where object_i 60D959D0 60D945B4
                      d= :"SYS_B_0"
 
       372        372 select * from t where object_i 60D959D0 60D76C00
                      d= :"SYS_B_0"
 
 
ops$tkyte@ORA9IR2> select *
  2    from v$sql_shared_cursor
  3   where KGLHDPAR = '&ADDR'
  4  /
old   3:  where KGLHDPAR = '&ADDR'
new   3:  where KGLHDPAR = '60D959D0'
 
ADDRESS  KGLHDPAR U S O O S L S E B P I S T A B D L T R I I R L I O S M U T N F
-------- -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
60D945B4 60D959D0 N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N
60D76C00 60D959D0 N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N
 
ops$tkyte@ORA9IR2>



<b>this is what cursor_sharing=similar is designed to do -- gives you the POSSIBILITY of reducing the number of child cursors.  But if a bind is detected as "not safe", it will become part of the signature of that child cursor and only sql with the same binds can reuse it.

Your 3rd party product has a serious bug, I'd be bashing on that vendor hard - really hard - to have it fixed.
</b>
(I still wonder why we have technlogy "bake offs", benchmark databases, drill down on how they work when we purchase them, but when it comes to an application, those with the prettiest screens win :(  We don't see to evaluate them using the same standards we do with core technology like an app server or database.  But we should)


Do you gather histograms with size greater than one?  That is what made the bind "unsafe" in this example... 

loop
   read input from user
   if input says "please exit" then EXIT the loop and quit
   else
      parse input
      bind input
      execute input
      close input
   end if
end loop