A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie     management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3     release (CVE-2025-27820)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16269 advisory.

  - A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie     management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3     release (CVE-2025-27820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-100164 advisory.

  - A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie     management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3     release (CVE-2025-27820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Java Delivery (Netty)). Supported versions that are affected are 23.4-23.7. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle     GoldenGate Big Data and Application Adapters. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GoldenGate Big Data     and Application Adapters. (CVE-2025-24970)

  - Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Stream     Analytics (Netty)). Difficult to exploit vulnerability allows low privileged attacker with access to     the physical communication segment attached to the hardware where the Oracle GoldenGate Stream Analytics     executes to compromise Oracle GoldenGate Stream Analytics. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle     GoldenGate Stream Analytics. (CVE-2025-25193)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Java Delivery (Apache HttpClient)). Supported versions that are affected are 23.4-23.6. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise     Oracle GoldenGate Big Data and Application Adapters. Successful attacks of this vulnerability can result     in unauthorized creation, deletion or modification access to critical data or all Oracle GoldenGate Big     Data and Application Adapters accessible data. (CVE-2025-27820)

  - Security-in-Depth issue in the Oracle GoldenGate Big Data and Application Adapters product of Oracle     GoldenGate (component: GoldenGate Big Data and Application Adapters (Apache Parquet Java)). This     vulnerability cannot be exploited in the context of this product. (CVE-2025-30065)

  - Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors     to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default     setting of trusted packages still allows malicious classes from these packages to be executed. The     exploit is only applicable if the client code of parquet-avro uses the 'specific' or the 'reflect'     models deliberately for reading Parquet files. ('generic' model is not impacted). (CVE-2025-46762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
259496	Linux Distros Unpatched Vulnerability : CVE-2025-27820	Nessus	Misc.	high
242986	Atlassian Jira Service Management Data Center and Server 5.12.23 < 5.12.24 / 10.3.x < 10.3.8 / 10.5.x < 10.7.2 (JSDSERVER-16269)	Nessus	Misc.	high
242980	Atlassian Confluence 9.2.4 < 9.2.6 / 9.4.x < 9.5.2 (CONFSERVER-100164)	Nessus	CGI abuses	high
242270	Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.9.0.25.07 (July 2025 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-27820

high

Tenable Plugins

high

high

high

critical