Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server. Supported versions that are     affected are 19.3-19.32 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated     attacker with network access via TLS to compromise RDBMS (OpenSSL). Successful attacks of this     vulnerability can result in takeover of RDBMS (OpenSSL). (CVE-2026-14456, CVE-2026-14457, CVE-2026-18798,     CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803)

  - Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are     23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR     privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability     can result in takeover of RDBMS. (CVE-2026-91499)

  - Vulnerability in the Oracle OLAP component of Oracle Database Server. Supported versions that are affected     are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged     attacker having DBMS_AW privilege with network access via Oracle Net to compromise Oracle OLAP. Successful     attacks of this vulnerability can result in takeover of Oracle OLAP. (CVE-2026-91563)

  - Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server. Supported versions that are     affected are 19.3-19.32 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise RDBMS (Micronaut). Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     RDBMS (Micronaut) accessible data as well as unauthorized read access to a subset of RDBMS (Micronaut)     accessible data. (CVE-2026-89044, CVE-2026-93492, CVE-2026-93493, CVE-2026-93494, CVE-2026-93560,     CVE-2026-93561, CVE-2026-93563, CVE-2026-93564, CVE-2026-93565, CVE-2026-93566, CVE-2026-93567,     CVE-2026-93568, CVE-2026-93569, CVE-2026-93572, CVE-2026-93573, CVE-2026-93574, CVE-2026-93575,     CVE-2026-93576, CVE-2026-93578, CVE-2026-93579)

  - Vulnerability in the VPD component of Oracle Database Server. Supported versions that are affected are     19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker     having Create Table privilege with network access via Oracle Net to compromise VPD. Successful attacks of     this vulnerability can result in unauthorized creation, deletion or modification access to critical data     or all VPD accessible data as well as unauthorized access to critical data or complete access to all VPD     accessible data. (CVE-2026-91503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to
    Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor
    implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted
    compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in
    the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse
    the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates
    a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This
    issue is fixed in version 3.4. (CVE-2025-67721)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Eclipse Jetty)). Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     Oracle GoldenGate Big Data and Application Adapters accessible data as well as unauthorized update, insert     or delete access to some of Oracle GoldenGate Big Data and Application Adapters accessible data.
    (CVE-2026-2332)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Netty)). Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Oracle GoldenGate Big Data and Application Adapters. (CVE-2026-33871)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Aircompressor)). Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     Oracle GoldenGate Big Data and Application Adapters accessible data. (CVE-2025-67721)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Eclipse Jetty)). Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     Oracle GoldenGate Big Data and Application Adapters accessible data as well as unauthorized update, insert     or delete access to some of Oracle GoldenGate Big Data and Application Adapters accessible data.
    (CVE-2026-2332)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Netty)). Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Oracle GoldenGate Big Data and Application Adapters. (CVE-2026-33871)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Third Party (Netty)). Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     GoldenGate Big Data and Application Adapters accessible data. (CVE-2026-33870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
370482	Oracle Database Server (October 2026 CPU)	Nessus	Databases	Local	critical
459646	Echo: aircompressor, io.airlift:aircompressor: security update to 2.0.3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459646	Echo: aircompressor, io.airlift:aircompressor: security update to 2.0.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
329323	Oracle GoldenGate for Big Data Multiple Vulnerabilities 21.x < 21.23.0.0.0 (July 2026 CPU)	Nessus	Misc.	Local	high
329321	Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.26.3.0.0 (July 2026 CPU)	Nessus	Misc.	Local	high
436376	SCA: security update for io.airlift:aircompressor, io.airlift:aircompressor-v3 (GHSA-vx9q-rhv9-3jvg)	Tenable Cloud Security	SCA Checks	Local	medium
436376	SCA: security update for io.airlift:aircompressor, io.airlift:aircompressor-v3 (GHSA-vx9q-rhv9-3jvg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-67721

medium

Tenable Plugins

Coming Soon

critical

medium

medium

high

high

medium

medium