# \[RELEASE\] ScyllaDB Java Driver 3.11.5.19 — 3.x enters maintenance mode **URL:** \ **Category:** Release Notes\ **Tags:** release, open-source, drivers, driver-release, java-driver\ **Created:** [September 30, 2026, 3:25pm UTC](https://forum.scylladb.com/t/release-scylladb-java-driver-3-11-5-19-3-x-enters-maintenance-mode/5520 "2026-09-30T15:25:02Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![nikagra](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.scylladb.com/nikagra/32/1923_2.png) [@nikagra](https://forum.scylladb.com/u/nikagra)\ **Post date:** [September 30, 2026, 3:25pm UTC](https://forum.scylladb.com/t/release-scylladb-java-driver-3-11-5-19-3-x-enters-maintenance-mode/5520/1 "2026-09-30T15:25:02Z")
Hi everyone, We’re announcing the release of **ScyllaDB Java Driver 3.11.5.19**. This release carries two things worth reading in full: **Java Driver 3.x is now deprecated and in maintenance mode** , and a **Critical-severity Netty CVE** is remediated. It also fixes a correctness bug in bind-variable name lookup that can bite on a ScyllaDB upgrade. ### ⚠ Java Driver 3.x is deprecated Starting with this release, **Java Driver 3.x enters maintenance mode** : only critical bug fixes will be accepted on the 3.x branch. Security fixes continue to land — this release carries one. Ongoing development happens on the 4.x line, and **we encourage all 3.x users to plan a migration to [Java Driver 4.x](https://java-driver.docs.scylladb.com/stable/)**. The 4.x line is a different major version and is not binary compatible with 3.x, but most concepts carry over directly. The [upgrading from 3.x guide](https://java-driver.docs.scylladb.com/stable/upgrade_guide/from_3x/) walks through the differences. If you’re running 3.x in production and the migration path isn’t obvious for your setup, reply on this thread — we’d rather help you plan it than have you discover the constraint later. ### What’s Changed **Security** - **CVE-2026-75595 (Netty, CRITICAL, CVSS 9.1):** `SslClientHelloHandler#decode` checks the wrong offset when a TLS ClientHello is fragmented across records — it ignores the 5-byte record header — so parsing throws, the generic catch selects the default `SslContext`, and per-SNI routing is silently bypassed. Where per-SNI selection is the only thing enforcing `clientAuth=REQUIRE`, an unauthenticated peer can bypass the mTLS gate entirely ([#1098](https://github.com/scylladb/java-driver/pull/1098)). - **CVE-2026-75596 (Netty, MEDIUM):** the same handshake-aggregation path recopies the whole buffer for every TLS record, so an unauthenticated peer can drive quadratic CPU work on the event loop ([#1098](https://github.com/scylladb/java-driver/pull/1098)). Both are fixed in Netty 4.1.137.Final; we’ve moved `netty.version` to the latest 4.1.x patch, **4.1.138.Final**. **Bug fixes** - **Bind-variable name lookup no longer depends on server-synthesized names (DRIVER-903)** ([#1021](https://github.com/scylladb/java-driver/pull/1021)). ScyllaDB synthesizes a name for every anonymous `?` marker, and **that spelling is not a contract** — it varies by release line rather than moving in one direction: 2024.1 emits `in(col)`, 2026.1.8 emits `IN(col)`, and 2026.1.12 / 2026.2.6 restore `in(col)`. Applications that bind by the synthesized name break on upgrade. Writing the coverage for this turned up two real defects on the 3.x lookup path: **Documentation** - Deprecation notice added to the 3.x README, pointing at 4.x ([#919](https://github.com/scylladb/java-driver/pull/919)). - Clarified that client routes are 4.x-only (DRIVER-1043) ([#1081](https://github.com/scylladb/java-driver/pull/1081)). - New connectivity section in the 3.x manual ([#1150](https://github.com/scylladb/java-driver/pull/1150)). ### Who should upgrade **All 3.x users.** Two groups should treat it as urgent: - Anyone whose application embeds Netty server-side with **SNI-based `SslContext` selection as the mTLS gate** — that’s the configuration CVE-2026-75595 actually breaks. If a permissive default context sits behind per-SNI `clientAuth=REQUIRE` with no application-layer certificate check, this is an unauthenticated bypass. - Anyone **binding `?` markers by name** , especially if a ScyllaDB upgrade is planned, or running on a JVM with a non-ROOT default locale. And whether or not either applies: this is a good moment to start planning the move to 4.x. ### Download / Coordinates xml ```xml com.scylladb scylla-driver-core 3.11.5.19 ``` ### Links - **GitHub Release:** [Release 3.11.5.19](https://github.com/scylladb/java-driver/releases/tag/3.11.5.19) - **Full Changelog:** [Comparing 3.11.5.18…3.11.5.19](https://github.com/scylladb/java-driver/compare/3.11.5.18...3.11.5.19) - **Java Driver 4.x:** [documentation](https://java-driver.docs.scylladb.com/stable/) · [upgrading from 3.x](https://java-driver.docs.scylladb.com/stable/upgrade_guide/from_3x/) As always, feel free to report any issues on [GitHub](https://github.com/scylladb/java-driver/issues).