[RELEASE] ScyllaDB CDC Source Connector v2.0.8

Release Notes
, , ,
1

Hi everyone,

We’re happy to announce the release of ScyllaDB CDC Source Connector v2.0.8. This release clears twelve CVEs across Jackson and lz4-java, and adds two new configuration options: an address translator for VPC-peered clusters, and control over how empty non-frozen collections are represented.

What’s Changed

Security

  • Seven Jackson CVEs (five HIGH) in jackson-core and jackson-databind — CVE-2026-68497, CVE-2026-19032, CVE-2026-83557, CVE-2026-89407, CVE-2026-89425, CVE-2026-91776 and CVE-2026-91777. These affected both the connector’s direct Jackson jars and the copy of Jackson shaded into scylla-cdc-driver3, so the fix moves Jackson to 2.22.3 and takes new upstream releases on both sides: scylla-cdc-java 1.3.17, whose shaded driver carries Jackson 2.18.11, and scylla-driver-core 3.11.5.20 so the direct jar matches the shaded copy (#310).
  • Five lz4-java CVEs, cleared by moving to 1.11.4 (#312, #313). The most serious is CVE-2026-106451 (HIGH, CVSS 7.3): when no system liblz4-java is present, the bundled native library was extracted to a predictable path in the shared temporary directory, so another local user able to write there could win a race and control the code loaded into the JVM. The remaining four are availability issues in the decompression entry points — unvalidated allocation sizes taken from input headers (CVE-2026-106453, CVE-2026-106452), buffer reallocation per frame allowing CPU and GC amplification (CVE-2026-106450), and recursion on empty blocks leading to StackOverflowError (CVE-2026-106449).

New configuration options

  • scylla.address.translator (NONE by default, or EC2_MULTI_REGION) (#311). A cluster that advertises public peer addresses — Scylla Cloud, for instance — is reachable at the contact point from a peered VPC but not at the peers the driver then discovers, because those public addresses aren’t routable there. Setting EC2_MULTI_REGION installs the driver’s EC2 multi-region address translator so those peers are reached on their private addresses. It requires DNS hostnames and DNS support enabled on both VPCs; the default preserves existing behaviour, and invalid values are rejected during connector validation rather than silently ignored.
  • cdc.non-frozen-collections.empty-representation (null by default, or empty) (#286). Scylla CDC cannot distinguish an explicit NULL from an explicitly emptied non-frozen collection when no element-level changes are present. The default continues to emit null for that ambiguous case; set empty to emit [] instead.

Documentation

  • The README now explains how to size the confidence window (#308).

Dependencies

  • scylla-cdc-java 1.3.16 → 1.3.17 and scylla-driver-core 3.11.5.19 → 3.11.5.20 (#310).
  • Jackson jackson-core and jackson-databind → 2.22.3 (#309, #306, #310), lz4-java → 1.11.4 (#291, #312, #313), jetty-server → 12.1.10 (#288), log4j-api → 2.25.5 (#296).

Who should upgrade

Recommended for all users, and promptly if you track vulnerability scans of the published Confluent Hub artifact — this release is intended to ship with no open findings. Both new options default to the previous behaviour, so the upgrade itself changes nothing about how your connectors run.

Links

As always, feel free to report any issues on GitHub.