[RELEASE] ScyllaDB Java Driver 3.11.5.19 — 3.x enters maintenance mode

Release Notes
, , , ,
1

Hi everyone,

We’re announcing the release of ScyllaDB Java Driver 3.11.5.19.

This release carries two things worth reading in full: Java Driver 3.x is now deprecated and in maintenance mode, and a Critical-severity Netty CVE is remediated. It also fixes a correctness bug in bind-variable name lookup that can bite on a ScyllaDB upgrade.

:warning: Java Driver 3.x is deprecated

Starting with this release, Java Driver 3.x enters maintenance mode: only critical bug fixes will be accepted on the 3.x branch. Security fixes continue to land — this release carries one.

Ongoing development happens on the 4.x line, and we encourage all 3.x users to plan a migration to Java Driver 4.x.

The 4.x line is a different major version and is not binary compatible with 3.x, but most concepts carry over directly. The upgrading from 3.x guide walks through the differences.

If you’re running 3.x in production and the migration path isn’t obvious for your setup, reply on this thread — we’d rather help you plan it than have you discover the constraint later.

What’s Changed

Security

  • CVE-2026-75595 (Netty, CRITICAL, CVSS 9.1): SslClientHelloHandler#decode checks the wrong offset when a TLS ClientHello is fragmented across records — it ignores the 5-byte record header — so parsing throws, the generic catch selects the default SslContext, and per-SNI routing is silently bypassed. Where per-SNI selection is the only thing enforcing clientAuth=REQUIRE, an unauthenticated peer can bypass the mTLS gate entirely (#1098).
  • CVE-2026-75596 (Netty, MEDIUM): the same handshake-aggregation path recopies the whole buffer for every TLS record, so an unauthenticated peer can drive quadratic CPU work on the event loop (#1098).

Both are fixed in Netty 4.1.137.Final; we’ve moved netty.version to the latest 4.1.x patch, 4.1.138.Final.

Bug fixes

  • Bind-variable name lookup no longer depends on server-synthesized names (DRIVER-903) (#1021). ScyllaDB synthesizes a name for every anonymous ? marker, and that spelling is not a contract — it varies by release line rather than moving in one direction: 2024.1 emits in(col), 2026.1.8 emits IN(col), and 2026.1.12 / 2026.2.6 restore in(col). Applications that bind by the synthesized name break on upgrade. Writing the coverage for this turned up two real defects on the 3.x lookup path:

    • ColumnDefinitions folded case using the JVM default locale on both the indexing and lookup sides. On a Turkish-locale JVM, IN(v) was indexed as ın(v) and in(v) never resolved.
    • A case-sensitive miss returned an empty array where callers read null as “no such name”. The consequences: contains() reported a name present that wasn’t, getIndexOf() threw instead of returning -1, and a name-based setter silently left the variable unset — which the server then rejects with Unexpected unset value for bind variable N.

    Case folding is now pinned to Locale.ROOT throughout: ColumnDefinitions, Metadata.handleId, querybuilder.Utils.handleId, DataType.Name.toString() (which the schema builder splices into generated CQL), and driver-mapping. In the mapper this covers explicit annotation names and the built-in NamingConventions; a custom NamingStrategy is unaffected. Recommended practice: bind ? markers positionally, and use named binding only with explicit :name markers. The manual now says so, and the observable change is recorded in the upgrade guide under 3.11.5.19.

Documentation

  • Deprecation notice added to the 3.x README, pointing at 4.x (#919).
  • Clarified that client routes are 4.x-only (DRIVER-1043) (#1081).
  • New connectivity section in the 3.x manual (#1150).

Who should upgrade

All 3.x users. Two groups should treat it as urgent:

  • Anyone whose application embeds Netty server-side with SNI-based SslContext selection as the mTLS gate — that’s the configuration CVE-2026-75595 actually breaks. If a permissive default context sits behind per-SNI clientAuth=REQUIRE with no application-layer certificate check, this is an unauthenticated bypass.
  • Anyone binding ? markers by name, especially if a ScyllaDB upgrade is planned, or running on a JVM with a non-ROOT default locale.

And whether or not either applies: this is a good moment to start planning the move to 4.x.

Download / Coordinates

xml

<dependency>
  <groupId>com.scylladb</groupId>
  <artifactId>scylla-driver-core</artifactId>
  <version>3.11.5.19</version>
</dependency>

Links

As always, feel free to report any issues on GitHub.