I encountered a bug where GeoTools reported more attributes for an Oracle database table then there were in the table.
I have tables named GDB$G_POZ_40_MPZP_DUKLA_XL_, GDB$G_POZ_40_MPZP_DUKLA_XLI and GDB$G_POZ_40_MPZP_DUKLA_XL0.
For the GDB$G_POZ_40_MPZP_DUKLA_XL_ table GeoTools returned attributes from all 3 tables.
After some investigation I found that when calling DatabaseMetaData.getColumns or getTables schema, table and colum names are passed as exact names whereas the API specifies them as a pattern. Bacause GDB$G_POZ_40_MPZP_DUKLA_XL_ ends with _ which is a placeholder for a single character, all tables matching this pattern were processed and their attributes collected.