[RELEASE] ScyllaDB CDC Source Connector v2.0.5

Release Notes
, , ,
1

Hi everyone,

We’re happy to announce the release of ScyllaDB CDC Source Connector v2.0.5. This is a patch release containing two dependency security fixes.

What’s Changed

Security

  • CVE-2026-59901 (Netty, HIGH, CVSS 8.7): an infinite loop in the run-length-encoding state machine of netty-codec’s Bzip2Decoder — a malformed bzip2 stream can permanently capture an event-loop thread, hanging it and denying service. Resolved for the unshaded netty dependency, which reached the connector at 4.1.135.Final via scylla-driver-core 3.11.5.17; all netty modules now resolve to 4.1.136.Final together through a netty-bom import (#294). See the note below on a second, shaded instance of this CVE.
  • CVE-2026-59949 (lz4-java, MEDIUM, CVSS 6.5): the JNI-backed XXHash implementations don’t fully validate their byte-array arguments, so a null array or an out-of-range off/len can reach native code and crash the JVM, with a possible out-of-bounds read beforehand. Fixed by bumping lz4-java to 1.11.1 (#294).

Dependencies

  • netty pinned to 4.1.136.Final through a netty-bom import, keeping all seven resolved modules on one coherent version (#294).
  • at.yawk.lz4:lz4-java updated from 1.10.2 to 1.11.1 (#294).

Known remaining finding

One finding is still open after this release: a second instance of CVE-2026-59901 in a copy of netty shaded into our upstream scylla-cdc-driver3 artifact. Because the vulnerable bytecode is physically relocated into that jar, it cannot be overridden by dependency management — clearing it requires new releases in two upstream projects, which is ongoing work tracked in #293.

Practical exposure for that copy is minimal: Bzip2Decoder only runs when a bzip2 handler is installed on a netty pipeline, and the CQL native protocol offers LZ4/Snappy frame compression only, so the driver never installs one. Scanners flag it based on the presence of the class.

Who should upgrade

Recommended for all users. If you track vulnerability scans of the published Confluent Hub artifact, this release clears both flagged CVEs for the unshaded dependencies; the shaded netty copy described above will still appear until the upstream releases land.

Links

As always, feel free to report any issues on GitHub.