Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

oracle CPUJan2026: Business Intelligence Enterprise Edition

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
    (CVE-2025-59250)

  - Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class     may excessively consume CPU resources when processing maliciously crafted input. (CVE-2024-47554)

  - Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol     servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline     characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per     HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension),     attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks.     (CVE-2025-58056)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The The Microsoft JDBC driver for MSSQL installed on the remote host is missing a security update. It is, therefore, affected by the following vulnerability:

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2025-59250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform
    spoofing over a network. (CVE-2025-59250)

ID	Name	Product	Family	Severity
294984	Oracle GoldenGate for Big Data Multiple Vulnerabilities 21.x < 21.21.0.0.0 (January 2026 CPU)	Nessus	Misc.	medium
278728	Security Updates for Microsoft JDBC driver for MSSQL (October 2025)	Nessus	Windows : Microsoft Bulletins	high
435911	SCA: security update for com.microsoft.sqlserver:mssql-jdbc (GHSA-m494-w24q-6f7w)	Tenable Cloud Security	SCA Checks	high
435911	SCA: security update for com.microsoft.sqlserver:mssql-jdbc (GHSA-m494-w24q-6f7w)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-59250

high

Tenable Plugins

Coming Soon

medium

high

high

high