Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Eclipse Jetty)). Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     Oracle GoldenGate Big Data and Application Adapters accessible data as well as unauthorized update, insert     or delete access to some of Oracle GoldenGate Big Data and Application Adapters accessible data.
    (CVE-2026-2332)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Netty)). Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Oracle GoldenGate Big Data and Application Adapters. (CVE-2026-33871)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Aircompressor)). Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     Oracle GoldenGate Big Data and Application Adapters accessible data. (CVE-2025-67721)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Eclipse Jetty)). Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     Oracle GoldenGate Big Data and Application Adapters accessible data as well as unauthorized update, insert     or delete access to some of Oracle GoldenGate Big Data and Application Adapters accessible data.
    (CVE-2026-2332)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Netty)). Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Oracle GoldenGate Big Data and Application Adapters. (CVE-2026-33871)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Netty)). Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     GoldenGate Big Data and Application Adapters accessible data. (CVE-2026-33870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to
    Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor
    implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted
    compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in
    the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse
    the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates
    a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This
    issue is fixed in version 3.4. (CVE-2025-67721)

ID	Name	Product	Family	Type	Severity
329323	Oracle GoldenGate for Big Data Multiple Vulnerabilities 21.x < 21.23.0.0.0 (July 2026 CPU)	Nessus	Misc.	Local	high
329321	Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.26.3.0.0 (July 2026 CPU)	Nessus	Misc.	Local	high
436376	SCA: security update for io.airlift:aircompressor, io.airlift:aircompressor-v3 (GHSA-vx9q-rhv9-3jvg)	Tenable Cloud Security	SCA Checks	Local	medium
436376	SCA: security update for io.airlift:aircompressor, io.airlift:aircompressor-v3 (GHSA-vx9q-rhv9-3jvg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-67721

medium

Tenable Plugins

high

high

medium

medium