Vulnerability · Published Oct 9, 2025 · Assigned by apache
CVE-2025-62228Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers
Medium 5.1
In plain English
A medium-severity SQL injection in Apache Flink CDC from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.flink:flink-cdc-pipeline-connectors | 3.5.0 | GHSA-wqm3-w3p6-xjgm |
| Maven | org.apache.flink:flink-connector-db2-cdc | 3.5.0 | GHSA-wqm3-w3p6-xjgm |
| Maven | org.apache.flink:flink-connector-mysql-cdc | 3.5.0 | GHSA-wqm3-w3p6-xjgm |
| Maven | org.apache.flink:flink-connector-oracle-cdc | 3.5.0 | GHSA-wqm3-w3p6-xjgm |
| Maven | org.apache.flink:flink-connector-sqlserver-cdc | 3.5.0 | GHSA-wqm3-w3p6-xjgm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Flink CDC | 3.0.0 – through 3.4.0 |
| Apache Software Foundation | Apache Flink CDC | 3.0.0 – through 3.4.0 |
| Apache Software Foundation | Apache Flink CDC | 3.0.0 – through 3.4.0 |
| Apache Software Foundation | Apache Flink CDC | 3.0.0 – through 3.4.0 |
| Apache Software Foundation | Apache Flink CDC | 3.3.0 – through 3.4.0 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/R:U/V:C/RE:L/U:Amber