# \[RELEASE\] ScyllaDB CDC Source Connector v2.0.6

**URL:** <https://forum.scylladb.com/t/release-scylladb-cdc-source-connector-v2-0-6/5475>\
**Category:** Release Notes\
**Tags:** release, open-source, cdc, kafka\
**Created:** [August 24, 2026, 12:22pm UTC](https://forum.scylladb.com/t/release-scylladb-cdc-source-connector-v2-0-6/5475 "2026-08-24T12:22:12Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nikagra](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.scylladb.com/nikagra/32/1923_2.png) [@nikagra](https://forum.scylladb.com/u/nikagra)\
**Post date:** [August 24, 2026, 12:22pm UTC](https://forum.scylladb.com/t/release-scylladb-cdc-source-connector-v2-0-6/5475/1 "2026-08-24T12:22:12Z")

</div>

Hi everyone,

We’re happy to announce the release of **ScyllaDB CDC Source Connector v2.0.6**. This release **completes the CVE remediation started in v2.0.5** , clearing the one finding that was still open.

### What’s Changed

**Security**

- **CVE-2026-59901 (Netty, HIGH, CVSS 8.7) — shaded copy now resolved.** v2.0.5 fixed the unshaded netty dependency, but a second instance of the same CVE remained in the copy of netty relocated into the upstream `scylla-cdc-driver3` artifact, which dependency management could not reach. Both upstream projects have now released fixes, and the connector consumes them: the shipped `scylla-cdc-driver3` jar embeds netty 4.1.136.Final ([#295](https://github.com/scylladb/scylla-cdc-source-connector/pull/295)).
- The temporary `netty-bom` pin added in v2.0.5 has been **removed**. Netty 4.1.136.Final now arrives transitively through the driver, so the stopgap is no longer needed ([#295](https://github.com/scylladb/scylla-cdc-source-connector/pull/295)).

**Dependencies**

- `scylla-driver-core` updated from 3.11.5.17 to 3.11.5.18 ([#295](https://github.com/scylladb/scylla-cdc-source-connector/pull/295)).
- `scylla-cdc-java` updated from 1.3.12 to 1.3.13 ([#295](https://github.com/scylladb/scylla-cdc-source-connector/pull/295)).
- `at.yawk.lz4:lz4-java` remains at 1.11.1, unchanged from v2.0.5.

With this release, all three rows from the vulnerability scan of the published v2.0.4 artifact are cleared — the lz4-java finding, the unshaded netty finding, and the shaded netty finding.

### Who should upgrade

Recommended for **all users**. In particular, if you are on v2.0.5 and track vulnerability scans of the published Confluent Hub artifact, this release removes the last remaining flagged CVE.

### Links

- **Full Changelog:** [Comparing v2.0.5…v2.0.6](https://github.com/scylladb/scylla-cdc-source-connector/compare/v2.0.5...v2.0.6)
- **GitHub Release:** [Release 2.0.6](https://github.com/scylladb/scylla-cdc-source-connector/releases/tag/v2.0.6)

As always, feel free to report any issues on [GitHub](https://github.com/scylladb/scylla-cdc-source-connector/issues).