[RELEASE] Kafka Connect ScyllaDB Sink Connector v1.1.6

Release Notes
, ,
1

Hi everyone,

We’re happy to announce the release of Kafka Connect ScyllaDB Sink Connector v1.1.6.
This is a patch release focused on security remediations.

What’s Changed

  • CVE-2026-44249 (Netty, CVSS 8.1): IpSubnetFilterRule.compareTo() performs an incorrect masking operation, allowing attackers to bypass IPv6 subnet ACL rules with crafted addresses.Fixed by overriding netty to 4.1.135.Final (#185).
  • CVE-2026-45416 (Netty, CVSS 7.5): SslClientHelloHandler.decode() allocates up to 16 MiB of unpooled memory per TLS ClientHello when using SniHandler defaults, allowing a peer to trigger memory exhaustion (DoS) with a crafted handshake. Fixed by overriding netty to 4.1.135.Final (#185).
  • Guava updated to 33.6.0-jre (#170)

Who should upgrade

This release is recommended for all users, particularly those whose connectors are reachable from untrusted network peers or use TLS with SNI routing.

Links

As always, feel free to report any issues on GitHub.