Repository navigation
fix: bump netty to 4.1.136.Final and lz4-java to 1.11.1 to remediate CVE-2026-59901 and CVE-2026-59949 - #990
Merged
dkropachev merged 1 commit intoAug 4, 2026
Conversation
…VE-2026-59901 and CVE-2026-59949 - CVE-2026-59901 (HIGH): Bzip2Decoder can be driven into a permanent infinite loop in the RLE state machine of Bzip2BlockDecompressor.read(), capturing the event-loop thread. Fixed in netty 4.1.136.Final. - CVE-2026-59949 (MEDIUM, CVSS 6.5): JNI-backed XXHash implementations do not validate their byte array arguments, so a null array or an out-of-range off/len can crash the JVM in GetPrimitiveArrayCritical. Fixed in lz4-java 1.11.1. Both are patch-level bumps driven entirely by the root POM properties; every netty/lz4 declaration already resolves through them. The driver's LZ4 usage (LZ4Factory.fastestInstance(), fastCompressor(), fastDecompressor()) does not touch the affected XXHash API, and netty stays on the 4.1.x line the driver is built against. The netty bump matches scylladb#978, which applied the same fix to scylla-4.x. Tracked in: scylladb/scylla-cdc-source-connector#293 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: QUIET Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe Maven build updates the managed Netty version to Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
This was referenced Aug 4, 2026
Merged
dkropachev
approved these changes
Aug 4, 2026
nikagra
added a commit
to nikagra/scylla-cdc-source-connector
that referenced
this pull request
Aug 19, 2026
Bumps scylla.driver.version 3.11.5.17 -> 3.11.5.18 and scylla.cdc.java.version 1.3.12 -> 1.3.13, then removes the netty-bom dependencyManagement import added in c0e03e3. The pin was only ever a stopgap for the unshaded netty that arrives via scylla-driver-core. With the fix released upstream it now flows transitively, and - crucially - the netty relocated into scylla-cdc-driver3 is rebuilt too, which no amount of dependencyManagement here could reach. This clears the last of the three CVE_Report.csv rows from the v2.0.4 Confluent Hub scan: - CVE-2026-59949 (lz4-java): lib/lz4-java-1.11.1.jar - CVE-2026-59901 (netty-codec, unshaded): lib/netty-codec-4.1.136.Final.jar - CVE-2026-59901 (netty-codec, shaded): scylla-cdc-driver3 now embeds netty 4.1.136.Final Requires scylladb/java-driver#990, released as 3.11.5.18 on 2026-08-18, and scylladb/scylla-cdc-java#188 to be merged and released as 1.3.13. Closes scylladb#293 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
nikagra
added a commit
to scylladb/scylla-cdc-java
that referenced
this pull request
Aug 19, 2026
Bumps scylla.driver.version from 3.11.5.17 to 3.11.5.18, which brings the following fixed transitive dependencies through the shade plugin: - netty 4.1.136.Final, fixing CVE-2026-59901 (HIGH): Bzip2Decoder can be driven into a permanent infinite loop in the RLE state machine of Bzip2BlockDecompressor.read(), capturing the event-loop thread. - lz4-java 1.11.1, fixing CVE-2026-59949 (MEDIUM, CVSS 6.5): JNI-backed XXHash implementations did not validate their byte array arguments, so a null array or an out-of-range off/len could crash the JVM. scylla-cdc-driver3 relocates io.netty. into the shaded jar, so the netty bytecode is embedded in the published artifact and no consumer can override it via dependencyManagement. A Confluent Hub scan of the Kafka connector flagged CVE-2026-59901 against scylla-cdc-driver3-1.3.12.jar for exactly that reason; rebuilding against the fixed driver is the only remedy. No netty override is added here. Unlike the Stage 1 stopgap in 5229bc4, the fix arrives transitively, leaving nothing to unwind later - the same shape as a352c30. Requires scylladb/java-driver#990 to be merged and scylla-3.x released. Tracked in: scylladb/scylla-cdc-source-connector#293 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
nikagra
added a commit
to nikagra/scylla-cdc-source-connector
that referenced
this pull request
Aug 20, 2026
Bumps scylla.driver.version 3.11.5.17 -> 3.11.5.18 and scylla.cdc.java.version 1.3.12 -> 1.3.13, then removes the netty-bom dependencyManagement import added in c0e03e3. The pin was only ever a stopgap for the unshaded netty that arrives via scylla-driver-core. With the fix released upstream it now flows transitively, and - crucially - the netty relocated into scylla-cdc-driver3 is rebuilt too, which no amount of dependencyManagement here could reach. This clears the last of the three CVE_Report.csv rows from the v2.0.4 Confluent Hub scan: - CVE-2026-59949 (lz4-java): lib/lz4-java-1.11.1.jar - CVE-2026-59901 (netty-codec, unshaded): lib/netty-codec-4.1.136.Final.jar - CVE-2026-59901 (netty-codec, shaded): scylla-cdc-driver3 now embeds netty 4.1.136.Final Requires scylladb/java-driver#990, released as 3.11.5.18 on 2026-08-18, and scylladb/scylla-cdc-java#188 to be merged and released as 1.3.13. Closes scylladb#293 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two patch-level dependency bumps on
scylla-3.x, both remediating CVEs found in a Confluent Hub scan of a downstream consumer (scylla-cdc-source-connectorv2.0.4).netty.versionlz4.versionCVE-2026-59901 — netty-codec, infinite loop in the bzip2 decoder
Bzip2Decodercan be driven into a permanent infinite loop by a malformed bzip2 stream, capturing the event-loop thread. The defect is in the run-length-encoding state machine inBzip2BlockDecompressor.read(). Fixed in netty 4.1.136.Final and 4.2.16.Final.This mirrors #978, which applied the identical netty bump to
scylla-4.x.scylla-3.xwas left behind, soscylla-driver-core:3.11.5.xstill ships the vulnerable codec.CVE-2026-59949 — lz4-java, JNI XXHash range validation
The JNI-backed XXHash implementations did not validate their byte array arguments before handing them to native code.
hash(null, 0, 0, seed)/update(null, 0, 0)could pass a null array reference to JNI, causing a fatal JVM crash inGetPrimitiveArrayCritical;update(new byte[16], 0, Integer.MAX_VALUE)could read far past the end of the Java array. Fixed in 1.11.1 with no user-code changes required.The driver's own LZ4 usage is unaffected by the behavioural change:
LZ4Compressor(driver-core/src/main/java/com/datastax/driver/core/LZ4Compressor.java) only usesLZ4Factory.fastestInstance(),fastCompressor()andfastDecompressor(), and never touches the XXHash API the advisory concerns.1.11.1also preserves thenet/jpountz/**package layout, so it is a drop-in replacement.Why this matters downstream
scylla-cdc-javashadesscylla-driver-core(relocatingio.netty.→shaded.com.scylladb.cdc.driver3.), so the netty version this branch resolves is baked intoscylla-cdc-driver3.jarand cannot be overridden by any consumer'sdependencyManagement. The Kafka connector currently carries anetty-bom:4.1.136.Finalpin purely as a stopgap for the unshaded copy; the shaded one can only be fixed here. Releasing this as 3.11.5.18 lets both clear properly.Scope
Root-POM properties only — no source changes. Every netty and lz4 declaration in the tree already resolves through these two properties (
driver-core/pom.xml,driver-tests/osgi/pom.xml,driver-tests/shading/shaded/pom.xmlall inherit or interpolate them), so there is nothing else to update.netty-tcnativeis versioned independently and untouched.Verification
4.1.136.Finalis published on Maven Central for every netty module this branch consumes (netty-handler,netty-codec,netty-transport-native-epoll).mvn -pl driver-core -am installon JDK 11 succeeds, and the resultingscylla-driver-core:3.11.5.18-SNAPSHOTwas consumed by a localscylla-cdc-javabuild to confirm the shade step picks up the fixed netty:Leaving the full test matrix to CI — these are dependency-property bumps with no source changes.
🤖 Generated with Claude Code