Detections
Analytics

Oracle GoldenGate for Big Data Multiple Vulnerabilities 21.x < 21.21.0.0.0 (January 2026 CPU)

medium Nessus Plugin ID 294984

Language:

Synopsis

The Oracle GoldenGate for Big Data application on the remote host is affected by multiple vulnerabilities.

Description

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

 - Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
 (CVE-2025-59250)

 - Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. (CVE-2024-47554)

 - Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. (CVE-2025-58056)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Oracle GoldenGate for Big Data version 21.21.0.0.0 or later.

See Also

https://www.oracle.com/security-alerts/cpujan2026.html

Plugin Details

Severity: Medium

ID: 294984

File Name: oracle_goldengate_for_big_data_cpu_jan_2026.nasl

Version: 1.3

Type: local

Agent: windows, macosx, unix

Family: Misc.

Published: 1/22/2026

Updated: 2/4/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2025-59250

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 5.5

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2025-59419

Vulnerability Information

CPE: cpe:/a:oracle:goldengate_application_adapters

Required KB Items: installed_sw/Oracle GoldenGate for Big Data

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/6/2026

Vulnerability Publication Date: 10/14/2025

Reference Information

CVE: CVE-2024-47554, CVE-2025-58056, CVE-2025-58057, CVE-2025-59250, CVE-2025-59419

IAVA: 2026-A-0065