PT-2026-21638

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...

Security Bulletin: IBM Event Processing is affected by multiple Vulnerabilities in IBM Operator for Apache Flink

Summary IBM Event Processing is affected by multiple Vulnerabilities in IBM Operator for Apache Flink 1.4.5 Vulnerability Details CVEID:CVE-2025-58056 DESCRIPTION: Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for Apache Flink

Summary Multiple vulnerabilities were addressed in IBM Operator for Apache Flink version 1.4.5 Vulnerability Details CVEID:CVE-2021-39194 DESCRIPTION: kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide...

SQL Injection

Apache Flink CDC is vulnerable to SQL Injection. The vulnerability is due to improper validation of user-supplied identifiers, such as crafted database or table names, which allows an attacker to inject malicious SQL and manipulate queries within the application...

CVE-2025-62228

Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue...

EUVD-2025-33342

Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers...

io.github.regychang:flinkify-flink-core (>=0.2.1 <=0.2.2) potentially affected by CVE-2025-62228 via org.apache.flink:flink-connector-oracle-cdc (=3.2.0)

org.apache.flink:flink-connector-oracle-cdc MAVEN version =3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-connector-oracle-cdc and may be impacted: - io.github.regychang:flinkify-flink-core =0.2.1, =0.2.2 Source cves:...

io.gitee.liwei0903nn:flink-cdc-spring-boot-starter (=1.0.0), io.github.regychang:flinkify-flink-core (>=0.2.1 <=0.2.2) potentially affected by CVE-2025-62228 via org.apache.flink:flink-connector-mysql-cdc (>=3.2.0 <=3.3.0)

org.apache.flink:flink-connector-mysql-cdc MAVEN version =3.2.0, =0.2.1, =0.2.2 Source cves: CVE-2025-62228 Source advisory: OSV:GHSA-WQM3-W3P6-XJGM...

io.github.regychang:flinkify-flink-core (>=0.2.1 <=0.2.2) potentially affected by CVE-2025-62228 via org.apache.flink:flink-connector-sqlserver-cdc (=3.2.0)

org.apache.flink:flink-connector-sqlserver-cdc MAVEN version =3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-connector-sqlserver-cdc and may be impacted: - io.github.regychang:flinkify-flink-core =0.2.1, =0.2.2 Source cves...

GHSA-WQM3-W3P6-XJGM Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

Apache Flink CDC version 3.0.0 to before 3.5.0 are vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, users are recommended to update Flink CDC version to 3.5.0...

Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

Apache Flink CDC version 3.0.0 to before 3.5.0 are vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, users are recommended to update Flink CDC version to 3.5.0...

CVE-2025-62228

Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue...

CVE-2025-62228

Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue...

io.github.regychang:flinkify-flink-core (>=0.2.1 <=0.2.2) potentially affected by CVE-2025-62228 via org.apache.flink:flink-connector-sqlserver-cdc (=3.2.0)

org.apache.flink:flink-connector-sqlserver-cdc MAVEN version =3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-connector-sqlserver-cdc and may be impacted: - io.github.regychang:flinkify-flink-core =0.2.1, =0.2.2 Source cves...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the quote function that fails to properly escape special characters. An attacker can execute arbitrary SQL commands by supplying specially crafted input values for database name or table names. Remediation Upgrade...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the quote function that fails to properly escape special characters. An attacker can execute arbitrary SQL commands by supplying specially crafted input values for database name or table names. Remediation Upgrade...

io.github.regychang:flinkify-flink-core (>=0.2.1 <=0.2.2) potentially affected by CVE-2025-62228 via org.apache.flink:flink-connector-oracle-cdc (=3.2.0)

org.apache.flink:flink-connector-oracle-cdc MAVEN version =3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-connector-oracle-cdc and may be impacted: - io.github.regychang:flinkify-flink-core =0.2.1, =0.2.2 Source cves:...

io.gitee.liwei0903nn:flink-cdc-spring-boot-starter (=1.0.0), io.github.regychang:flinkify-flink-core (>=0.2.1 <=0.2.2) potentially affected by CVE-2025-62228 via org.apache.flink:flink-connector-mysql-cdc (>=3.2.0 <=3.3.0)

org.apache.flink:flink-connector-mysql-cdc MAVEN version =3.2.0, =0.2.1, =0.2.2 Source cves: CVE-2025-62228 Source advisory: SNYK:JAVA-ORGAPACHEFLINK-13539423...

CVE-2025-62228 Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers

Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue...

CVE-2025-62228 Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers

Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue...