[RELEASE] ScyllaDB CDC Source Connector v2.0.4

Release Notes
, , ,
1

Hi everyone,

We’ve released ScyllaDB CDC Source Connector v2.0.4. This is a security-focused
patch release that remediates a set of Netty and Jackson CVEs across the connector
and its bundled dependencies.

What’s Changed

Security

  • CVE-2026-54512 (jackson-databind, CVSS 8.1): PolymorphicTypeValidator allow-list bypass — a denied class can be smuggled in as a generic type parameter of an allowed container (e.g. java.util.ArrayList<com.evil.Gadget>), enabling deserialization of untrusted classes.
  • CVE-2026-54513 (jackson-databind, CVSS 8.1): allowIfSubTypeIsArray() allow-lists any array type without validating the component type, bypassing the PTV allow-list.
  • CVE-2026-54514 / 54515 / 54516 / 54517 / 54518 (jackson-databind, MEDIUM): eager DNS resolution during deserialization, plus @JsonIgnoreProperties, @JsonIgnore, and @JsonView/@JsonUnwrapped filter bypasses.
  • CVE-2026-44249 (Netty, CVSS 8.1): IpSubnetFilterRule.compareTo() performs an incorrect masking operation, allowing attackers to bypass IPv6 subnet ACL rules with valid public IP addresses.
  • CVE-2026-45416 (Netty, CVSS 7.5): SslClientHelloHandler.decode() eagerly allocates up to 16 MiB of unpooled memory per TLS ClientHello under SniHandler defaults, allowing memory-exhaustion DoS.
  • CVE-2026-50010 (Netty, CVSS 7.5): improper trust-manager handling disables TLS hostname verification in some configurations, enabling MITM.

These are remediated transitively via upstream bumps rather than local pins:

  • ScyllaDB Java Driver 3.11.5.17 — ships fixed Netty (4.1.135.Final) and Jackson (2.18.9) (#287).
  • scylla-cdc-java 1.3.12 — the shaded scylla-cdc-driver3 now embeds the fixed Netty (4.1.135.Final) and Jackson (2.18.9) (#287).
  • jackson-databind 2.22.1 — the connector’s own Jackson is bumped above all affected versions (#283).

Other changes

  • docs: added a Debezium Docker image example (#285).
  • ci: pinned GitHub Actions to commit SHAs (#275); fixed the test-email workflow (#279).

Who should upgrade

This release is recommended for all users on 2.0.x, particularly those whose
connectors are reachable from untrusted network peers or use TLS with SNI routing.
It is a drop-in upgrade — no configuration or API changes.

Links

As always, feel free to report any issues on GitHub.