From 236a3018c24876daff7c6709cf99f4651d63d19b Mon Sep 17 00:00:00 2001 From: Mikita Hradovich Date: Tue, 4 Aug 2026 23:08:39 +0200 Subject: [PATCH] fix: bump netty to 4.1.136.Final and lz4-java to 1.11.1 to remediate CVE-2026-59901 and CVE-2026-59949 - CVE-2026-59901 (HIGH): Bzip2Decoder can be driven into a permanent infinite loop in the RLE state machine of Bzip2BlockDecompressor.read(), capturing the event-loop thread. Fixed in netty 4.1.136.Final. - CVE-2026-59949 (MEDIUM, CVSS 6.5): JNI-backed XXHash implementations do not validate their byte array arguments, so a null array or an out-of-range off/len can crash the JVM in GetPrimitiveArrayCritical. Fixed in lz4-java 1.11.1. Both are patch-level bumps driven entirely by the root POM properties; every netty/lz4 declaration already resolves through them. The driver's LZ4 usage (LZ4Factory.fastestInstance(), fastCompressor(), fastDecompressor()) does not touch the affected XXHash API, and netty stays on the 4.1.x line the driver is built against. The netty bump matches #978, which applied the same fix to scylla-4.x. Tracked in: scylladb/scylla-cdc-source-connector#293 Co-Authored-By: Claude Opus 5 (1M context) --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index d6c97121022..88a6c1a6e9f 100644 --- a/pom.xml +++ b/pom.xml @@ -56,12 +56,12 @@ 1.7.36 1.7.36 33.3.1-jre - 4.1.135.Final + 4.1.136.Final netty-tcnative-boringssl-static 2.0.70.Final 3.2.6 1.1.10.7 - 1.10.1 + 1.11.1 2.2.2 2.18.9 2.12.7