[RELEASE] Kafka Connect ScyllaDB Sink Connector v1.1.8

Release Notes
, ,
1

Hi everyone,

We’re happy to announce the release of Kafka Connect ScyllaDB Sink Connector v1.1.8. This is a small patch release containing two dependency security fixes.

What’s Changed

Security

  • CVE-2026-59901 (Netty, HIGH, CVSS 8.7): an infinite loop in the run-length-encoding state machine of netty-codec’s Bzip2Decoder — a malformed bzip2 stream can permanently capture an event-loop thread, hanging it and denying service. Fixed by forcing netty to 4.1.136.Final (#204).
  • CVE-2026-59949 (lz4-java, MEDIUM, CVSS 6.5): the JNI-backed XXHash implementations don’t fully validate their byte-array arguments, so a null array or an out-of-range off/len can reach native code and crash the JVM, with a possible out-of-bounds read beforehand. Fixed by bumping lz4-java to 1.11.1 (#204).

Dependencies

  • netty forced to 4.1.136.Final through a netty-bom import, since it arrives transitively via ScyllaDB Java Driver 4.19.2.0 (#204).
  • at.yawk.lz4:lz4-java updated from 1.11.0 to 1.11.1 (#204).

Who should upgrade

Neither vulnerability is believed to be reachable through this connector’s code paths: the driver uses netty for the CQL binary protocol, so Bzip2Decoder is never installed in the pipeline, and lz4-java is called by the driver’s frame compressor with correctly bounded arrays. Even so, we recommend the upgrade for all users, and it is required if you depend on a clean Confluent Hub security scan.

The netty version override is a temporary measure. The upstream fix has already been merged into the ScyllaDB Java Driver, and the override will be removed once a driver release containing it is available.

Links

As always, feel free to report any issues on GitHub.