[RELEASE] ScyllaDB Java Driver3.11.5.18

Release Notes
, , ,
1

Hi everyone,

We’re happy to announce the release of ScyllaDB Java Driver 3.11.5.18. This is a patch release covering two CVE remediations and the two stages of client config reporting.

What’s Changed

Security

  • CVE-2026-59901 (Netty, HIGH): an infinite loop in Bzip2Decoder can hang the event-loop thread it runs on, taking down request processing for every connection sharing that thread. Fixed by pinning Netty to 4.1.136.Final (#990).
  • CVE-2026-59949 (lz4-java, MEDIUM): the XXHash JNI entry points do not validate their arguments, so out-of-range offsets or lengths reach native code and can crash the JVM. Fixed by bumping lz4-java to 1.11.1 (#990).

Improvements

  • Client config reporting — stage 1 (groundwork): SESSION_ID and DRIVER_CONFIG plumbing (#973).
  • Client config reporting — stage 2: the driver now sends a full DRIVER_CONFIG report, so its effective configuration is visible cluster-side for diagnostics (#974).

Dependencies

  • Jackson modules aligned with the BOM, preventing mixed-version Jackson combinations on the classpath (#988).
  • Netty pinned to 4.1.136.Final, lz4-java bumped to 1.11.1 (#990).

Who should upgrade

Recommended for all 3.x users. The two findings are reachable through the driver’s own networking and compression paths, so upgrading is the cleanest way to clear them — and both will otherwise keep showing up in dependency scans.

Download / Coordinates

xml

<dependency>
  <groupId>com.scylladb</groupId>
  <artifactId>scylla-driver-core</artifactId>
  <version>3.11.5.18</version>
</dependency>

Links

Thanks to @nikagra and @dkropachev for the work in this release.

As always, feel free to report any issues on GitHub.