[RELEASE] Kafka Connect ScyllaDB Sink Connector v1.1.5

Release Notes
, ,
1

Hi everyone,

We’re happy to announce the release of Kafka Connect ScyllaDB Sink Connector v1.1.5. This is a patch release focused on security remediations for transitive dependencies.

What’s Changed

  • CVE-2026-35554 (Kafka Clients): A race condition in the Kafka Java producer buffer pool could cause silent message misrouting and data corruption. Fixed by bumping kafka-clients to 3.9.2. (#163)
  • CVE-2026-42583 (Netty): Lz4FrameDecoder in netty-codec prior to 4.1.133.Final allocates up to 32 MB per block before decompression, allowing a peer to trigger memory exhaustion (DoS) with a crafted LZ4 header. Fixed by overriding netty to 4.1.133.Final. (#165)
  • Jackson updated to 2.21.3. (#157)
  • ScyllaDB Java Driver updated to 4.19.0.9. (#159)

Who should upgrade

This release is recommended for all users, especially those running in environments exposed to untrusted network peers (due to the Netty DoS fix) or producing to multiple topics (due to the Kafka data corruption fix).

Links

As always, feel free to report any issues on GitHub.