Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Maximum severity flaw (CVSS 10.0) disclosed. Exploitation requires an attacker to trick a vulnerable system into reading a specially crafted file. Monitoring for PoC exploits.

oracle CPUJul2025: WebLogic Server

oracle CPUJul2025: WebCenter Portal

oracle CPUJul2025: Business Intelligence Enterprise Edition

oracle CPUJul2025: Identity Manager

oracle CPUJul2025: Oracle Analytics Server

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Java Delivery (Netty)). Supported versions that are affected are 23.4-23.7. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle     GoldenGate Big Data and Application Adapters. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GoldenGate Big Data     and Application Adapters. (CVE-2025-24970)

  - Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Stream     Analytics (Netty)). Difficult to exploit vulnerability allows low privileged attacker with access to     the physical communication segment attached to the hardware where the Oracle GoldenGate Stream Analytics     executes to compromise Oracle GoldenGate Stream Analytics. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle     GoldenGate Stream Analytics. (CVE-2025-25193)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Java Delivery (Apache HttpClient)). Supported versions that are affected are 23.4-23.6. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise     Oracle GoldenGate Big Data and Application Adapters. Successful attacks of this vulnerability can result     in unauthorized creation, deletion or modification access to critical data or all Oracle GoldenGate Big     Data and Application Adapters accessible data. (CVE-2025-27820)

  - Security-in-Depth issue in the Oracle GoldenGate Big Data and Application Adapters product of Oracle     GoldenGate (component: GoldenGate Big Data and Application Adapters (Apache Parquet Java)). This     vulnerability cannot be exploited in the context of this product. (CVE-2025-30065)

  - Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors     to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default     setting of trusted packages still allows malicious classes from these packages to be executed. The     exploit is only applicable if the client code of parquet-avro uses the 'specific' or the 'reflect'     models deliberately for reading Parquet files. ('generic' model is not impacted). (CVE-2025-46762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Security-in-Depth issue in the Oracle GoldenGate Big Data and Application Adapters product of Oracle     GoldenGate (component: GoldenGate Big Data and Application Adapters (Apache Parquet Java)). This     vulnerability cannot be exploited in the context of this product. (CVE-2025-30065)

  - Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors     to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default     setting of trusted packages still allows malicious classes from these packages to be executed. The     exploit is only applicable if the client code of parquet-avro uses the 'specific' or the 'reflect'     models deliberately for reading Parquet files. ('generic' model is not impacted). (CVE-2025-46762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Parquet on the remote host is prior to 1.15.1. It is, therefore, affected by a remote code execution vulnerability:

  - Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to     execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue. (CVE-2025-30065)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242270	Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.9.0.25.07 (July 2025 CPU)	Nessus	Misc.	critical
242269	Oracle GoldenGate for Big Data Multiple Vulnerabilities 21.x < 21.19.0.0.0 (July 2025 CPU)	Nessus	Misc.	critical
234234	Apache Parquet < 1.15.1 Remote Code Execution (CVE-2025-30065)	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-30065

critical

Tenable Plugins

Coming Soon

critical

critical

critical