GitHub Advisoryadvisory · Maven

GHSA-wqm3-w3p6-xjgm Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

MEDIUM Published 2025-10-09 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-62228
Ecosystem
Maven
Packages
org.apache.flink:flink-cdc-pipeline-connectors, org.apache.flink:flink-connector-oracle-cdc, org.apache.flink:flink-connector-db2-cdc, org.apache.flink:flink-connector-sqlserver-cdc, org.apache.flink:flink-connector-mysql-cdc
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Weaknesses
CWE-89
Reviewed
2025-10-09

Affected packages

• Maven org.apache.flink:flink-cdc-pipeline-connectors: >= 3.0.0, < 3.5.0 → fixed in 3.5.0 • Maven org.apache.flink:flink-connector-oracle-cdc: >= 3.0.0, < 3.5.0 → fixed in 3.5.0 • Maven org.apache.flink:flink-connector-db2-cdc: >= 3.0.0, < 3.5.0 → fixed in 3.5.0 • Maven org.apache.flink:flink-connector-sqlserver-cdc: >= 3.0.0, < 3.5.0 → fixed in 3.5.0 • Maven org.apache.flink:flink-connector-mysql-cdc: >= 3.0.0, < 3.5.0 → fixed in 3.5.0

Description

Apache Flink CDC version 3.0.0 to before 3.5.0 are vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, users are recommended to update Flink CDC version to 3.5.0 which address this issue.

Related

Alias · CVE (1)

  • CVE-2025-62228 Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References