# \[RELEASE\] ScyllaDB CDC Source Connector v2.0.8 **URL:** \ **Category:** Release Notes\ **Tags:** release, open-source, cdc, kafka\ **Created:** [October 15, 2026, 2:45pm UTC](https://forum.scylladb.com/t/release-scylladb-cdc-source-connector-v2-0-8/5545 "2026-10-15T14:45:41Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![nikagra](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.scylladb.com/nikagra/32/1923_2.png) [@nikagra](https://forum.scylladb.com/u/nikagra)\ **Post date:** [October 15, 2026, 2:45pm UTC](https://forum.scylladb.com/t/release-scylladb-cdc-source-connector-v2-0-8/5545/1 "2026-10-15T14:45:41Z")
Hi everyone, We’re happy to announce the release of **ScyllaDB CDC Source Connector v2.0.8**. This release clears **twelve CVEs** across Jackson and lz4-java, and adds two new configuration options: an address translator for VPC-peered clusters, and control over how empty non-frozen collections are represented. ### What’s Changed **Security** - **Seven Jackson CVEs (five HIGH)** in `jackson-core` and `jackson-databind` — CVE-2026-68497, CVE-2026-19032, CVE-2026-83557, CVE-2026-89407, CVE-2026-89425, CVE-2026-91776 and CVE-2026-91777. These affected both the connector’s direct Jackson jars and the copy of Jackson shaded into `scylla-cdc-driver3`, so the fix moves Jackson to 2.22.3 and takes new upstream releases on both sides: `scylla-cdc-java` 1.3.17, whose shaded driver carries Jackson 2.18.11, and `scylla-driver-core` 3.11.5.20 so the direct jar matches the shaded copy ([#310](https://github.com/scylladb/scylla-cdc-source-connector/pull/310)). - **Five lz4-java CVEs** , cleared by moving to 1.11.4 ([#312](https://github.com/scylladb/scylla-cdc-source-connector/pull/312), [#313](https://github.com/scylladb/scylla-cdc-source-connector/pull/313)). The most serious is **CVE-2026-106451 (HIGH, CVSS 7.3)**: when no system `liblz4-java` is present, the bundled native library was extracted to a predictable path in the shared temporary directory, so another local user able to write there could win a race and control the code loaded into the JVM. The remaining four are availability issues in the decompression entry points — unvalidated allocation sizes taken from input headers (CVE-2026-106453, CVE-2026-106452), buffer reallocation per frame allowing CPU and GC amplification (CVE-2026-106450), and recursion on empty blocks leading to `StackOverflowError` (CVE-2026-106449). **New configuration options** - **`scylla.address.translator`** (`NONE` by default, or `EC2_MULTI_REGION`) ([#311](https://github.com/scylladb/scylla-cdc-source-connector/pull/311)). A cluster that advertises public peer addresses — Scylla Cloud, for instance — is reachable at the contact point from a peered VPC but not at the peers the driver then discovers, because those public addresses aren’t routable there. Setting `EC2_MULTI_REGION` installs the driver’s EC2 multi-region address translator so those peers are reached on their private addresses. It requires DNS hostnames and DNS support enabled on both VPCs; the default preserves existing behaviour, and invalid values are rejected during connector validation rather than silently ignored. - **`cdc.non-frozen-collections.empty-representation`** (`null` by default, or `empty`) ([#286](https://github.com/scylladb/scylla-cdc-source-connector/pull/286)). Scylla CDC cannot distinguish an explicit `NULL` from an explicitly emptied non-frozen collection when no element-level changes are present. The default continues to emit `null` for that ambiguous case; set `empty` to emit `[]` instead. **Documentation** - The README now explains how to size the confidence window ([#308](https://github.com/scylladb/scylla-cdc-source-connector/pull/308)). **Dependencies** - `scylla-cdc-java` 1.3.16 → 1.3.17 and `scylla-driver-core` 3.11.5.19 → 3.11.5.20 ([#310](https://github.com/scylladb/scylla-cdc-source-connector/pull/310)). - Jackson `jackson-core` and `jackson-databind` → 2.22.3 ([#309](https://github.com/scylladb/scylla-cdc-source-connector/pull/309), [#306](https://github.com/scylladb/scylla-cdc-source-connector/pull/306), [#310](https://github.com/scylladb/scylla-cdc-source-connector/pull/310)), `lz4-java` → 1.11.4 ([#291](https://github.com/scylladb/scylla-cdc-source-connector/pull/291), [#312](https://github.com/scylladb/scylla-cdc-source-connector/pull/312), [#313](https://github.com/scylladb/scylla-cdc-source-connector/pull/313)), `jetty-server` → 12.1.10 ([#288](https://github.com/scylladb/scylla-cdc-source-connector/pull/288)), `log4j-api` → 2.25.5 ([#296](https://github.com/scylladb/scylla-cdc-source-connector/pull/296)). ### Who should upgrade Recommended for **all users** , and promptly if you track vulnerability scans of the published Confluent Hub artifact — this release is intended to ship with no open findings. Both new options default to the previous behaviour, so the upgrade itself changes nothing about how your connectors run. ### Links - **Full Changelog:** [Comparing v2.0.7…v2.0.8](https://github.com/scylladb/scylla-cdc-source-connector/compare/v2.0.7...v2.0.8) - **GitHub Release:** [Release v2.0.8](https://github.com/scylladb/scylla-cdc-source-connector/releases/tag/v2.0.8) As always, feel free to report any issues on [GitHub](https://github.com/scylladb/scylla-cdc-source-connector/issues).