Riskcovery

CVE-2025-62228

Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers

State
Published
Severity
5.1 Medium
Published
Oct 9, 2025
Updated
Nov 4, 2025
Reserved
Oct 9, 2025

Read the record on cve.org

Description

Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue.

Scores

CVSSScoreVectorSource
4.05.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/R:U/V:C/RE:L/U:Amberapache

Weaknesses

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

ProductVersions
Apache Flink CDCApache Software Foundation
  • 3.0.0 through 3.4.0Affected
Apache Flink CDCApache Software Foundation
  • 3.0.0 through 3.4.0Affected
Apache Flink CDCApache Software Foundation
  • 3.0.0 through 3.4.0Affected
Apache Flink CDCApache Software Foundation
  • 3.0.0 through 3.4.0Affected
Apache Flink CDCApache Software Foundation
  • 3.3.0 through 3.4.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.