# \[RELEASE\] Scylla CDC Source Connector v2.0.3 **URL:** \ **Category:** Release Notes\ **Tags:** release, open-source, cdc, kafka\ **Created:** [June 21, 2026, 9:53am UTC](https://forum.scylladb.com/t/release-scylla-cdc-source-connector-v2-0-3/5416 "2026-06-21T09:53:32Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![nikagra](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.scylladb.com/nikagra/32/1923_2.png) [@nikagra](https://forum.scylladb.com/u/nikagra)\ **Post date:** [June 21, 2026, 9:53am UTC](https://forum.scylladb.com/t/release-scylla-cdc-source-connector-v2-0-3/5416/1 "2026-06-21T09:53:32Z")
We’re happy to announce the **v2.0.3** release of the Scylla CDC Source Connector. This is a patch release focused on **security remediations**. * * * ### πŸ›‘ Security Updates Two HIGH severity vulnerabilities in `netty-handler` have been addressed by overriding the transitive netty dependency to 4.2.15.Final ([#277](https://github.com/scylladb/scylla-cdc-source-connector/pull/277)): - **CVE-2026-44249 (CVSS 8.1):** `IpSubnetFilterRule.compareTo()` performs an incorrect masking operation, allowing attackers to bypass IPv6 subnet ACL rules with crafted addresses. - **CVE-2026-45416 (CVSS 7.5):** `SslClientHelloHandler.decode()` allocates up to 16 MiB of unpooled memory per TLS ClientHello when using `SniHandler` defaults, allowing a peer to trigger memory exhaustion (DoS) with a crafted handshake. * * * ### πŸ”— Links - [GitHub Release](https://github.com/scylladb/scylla-cdc-source-connector/releases/tag/v2.0.3) - [Full Changelog (v2.0.2 β†’ v2.0.3)](https://github.com/scylladb/scylla-cdc-source-connector/compare/v2.0.2...v2.0.3) - Download: [`scylla-cdc-source-connector-2.0.3-jar-with-dependencies.jar`](https://github.com/scylladb/scylla-cdc-source-connector/releases/download/v2.0.3/scylla-cdc-sourceconnector-2.0.3-jar-with-dependencies.jar) * * * If you have any questions or issues, please open a ticket on