# \[RELEASE\] ScyllaDB Java Driver 4.19.2.1

**URL:** <https://forum.scylladb.com/t/release-scylladb-java-driver-4-19-2-1/5472>\
**Category:** Release Notes\
**Tags:** release, open-source, drivers, java-driver\
**Created:** [August 19, 2026, 10:51am UTC](https://forum.scylladb.com/t/release-scylladb-java-driver-4-19-2-1/5472 "2026-08-19T10:51:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nikagra](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.scylladb.com/nikagra/32/1923_2.png) [@nikagra](https://forum.scylladb.com/u/nikagra)\
**Post date:** [August 19, 2026, 10:51am UTC](https://forum.scylladb.com/t/release-scylladb-java-driver-4-19-2-1/5472/1 "2026-08-19T10:51:11Z")

</div>

Hi everyone,

We’re happy to announce the release of **ScyllaDB Java Driver 4.19.2.1**. This is a patch release focused on **security dependency updates** , plus the first two stages of **client config reporting** and a few documentation build fixes.

### What’s Changed

**Security**

- **CVE-2026-59901 (Netty, HIGH):** an infinite loop in `Bzip2Decoder` can hang the event-loop thread it runs on, stalling request processing for every connection on that thread. Fixed by moving Netty to 4.1.136.Final ([#978](https://github.com/scylladb/java-driver/pull/978), following [#921](https://github.com/scylladb/java-driver/pull/921)).
- **CVE-2026-59949 (lz4-java, MEDIUM):** unvalidated arguments on the XXHash JNI entry points let out-of-range offsets or lengths reach native code, crashing the JVM. Fixed by bumping lz4-java to 1.11.1 ([#976](https://github.com/scylladb/java-driver/pull/976)).
- **Jackson security updates:** `jackson-databind` ([#934](https://github.com/scylladb/java-driver/pull/934)) and `jackson-core` to 2.21.4 ([#972](https://github.com/scylladb/java-driver/pull/972)).
- **Micrometer security update:** `micrometer-core` to 1.15.12 ([#995](https://github.com/scylladb/java-driver/pull/995), [#994](https://github.com/scylladb/java-driver/pull/994)).

**Improvements**

- **Client config reporting — stage 1 (groundwork):** `SESSION_ID` and `DRIVER_CONFIG` plumbing ([#967](https://github.com/scylladb/java-driver/pull/967)).
- **Client config reporting — stage 2:** the driver now sends a full `DRIVER_CONFIG` report, making its effective configuration visible cluster-side for diagnostics ([#968](https://github.com/scylladb/java-driver/pull/968)).

**Dependencies**

- Jackson modules aligned with the BOM, preventing mixed-version Jackson on the classpath ([#987](https://github.com/scylladb/java-driver/pull/987)).
- `jackson-databind` test dependency 2.22.0 → 2.22.1 ([#970](https://github.com/scylladb/java-driver/pull/970)).

**Documentation**

- Docs theme updated to 1.9.3 ([#977](https://github.com/scylladb/java-driver/pull/977)).
- Fixed the multiversion docs build failing with javadoc errors on older branches ([#991](https://github.com/scylladb/java-driver/pull/991)).

### New contributors

Welcome to @annastuchlik, who made their first contribution in [#930](https://github.com/scylladb/java-driver/pull/930). 🎉

### Who should upgrade

Recommended for **all 4.x users**. Everything here is a drop-in patch update — no API changes — and it clears the Netty, lz4-java, Jackson, and Micrometer findings in one step.

### Download / Coordinates

xml

```auto
<dependency>
  <groupId>com.scylladb</groupId>
  <artifactId>java-driver-core</artifactId>
  <version>4.19.2.1</version>
</dependency>

```

### Links

- **GitHub Release:** [Release 4.19.2.1](https://github.com/scylladb/java-driver/releases/tag/4.19.2.1)
- **Full Changelog:** [Comparing 4.19.2.0…4.19.2.1](https://github.com/scylladb/java-driver/compare/4.19.2.0...4.19.2.1)

Thanks to @nikagra, @dkropachev, @dgarcia360, @annastuchlik, and our Renovate/Dependabot bots.

As always, feel free to report any issues on [GitHub](https://github.com/scylladb/java-driver/issues).