CVE-2025-62228 Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2025-62228?
CVE-2025-62228 is a medium-severity vulnerability in Apache Flink CDC, published on 9 Oct 2025.
Official description
Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue.
Weakness: CWE-89
Which versions are affected by CVE-2025-62228?
10 open source packages ship an affected version, including org.apache.flink:flink-cdc-pipeline-connectors, org.apache.flink:flink-connector-db2-cdc and org.apache.flink:flink-connector-mysql-cdc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.flink:flink-cdc-pipeline-connectors Maven | From 3.0.0 | 3.5.0 |
org.apache.flink:flink-cdc-pipeline-connectors Maven | From 3.0.0 | 3.5.0 |
org.apache.flink:flink-connector-db2-cdc Maven | From 3.0.0 | 3.5.0 |
org.apache.flink:flink-connector-db2-cdc Maven | From 3.0.0 | 3.5.0 |
org.apache.flink:flink-connector-mysql-cdc Maven | From 3.0.0 | 3.5.0 |
org.apache.flink:flink-connector-mysql-cdc Maven | From 3.0.0 | 3.5.0 |
4 more packages
org.apache.flink:flink-connector-oracle-cdc Maven | From 3.0.0 | 3.5.0 |
org.apache.flink:flink-connector-oracle-cdc Maven | From 3.0.0 | 3.5.0 |
org.apache.flink:flink-connector-sqlserver-cdc Maven | From 3.0.0 | 3.5.0 |
org.apache.flink:flink-connector-sqlserver-cdc Maven | From 3.0.0 | 3.5.0 |
Products include Apache Flink Cdc.
How do I fix CVE-2025-62228?
Upgrade org.apache.flink:flink-cdc-pipeline-connectors to 3.5.0 or later.
Is CVE-2025-62228 being exploited?
There is no known exploitation of CVE-2025-62228 in the wild and no public exploit code.
Sources
Also known as GHSA-wqm3-w3p6-xjgm.