Liquibase Secure 5.1.1 release notes
Released on March 26, 2026
What's Included
Liquibase 5.1.1 is a minor patch release providing fixes and enhanced support for Microsoft SQL Server CLR objects, Databricks and OAUTH connections, Multi-schema Oracle environments, Snowflake change types in JSON/YAML, and addressing a CVE with upstream vendors. The key benefits of the release are:
SQL Server CLR Object Support – Comprehensive fixes for CLR stored procedure, function, aggregate, trigger, and table-valued function snapshot and changelog generation on SQL Server.
Databricks Support – Fixed OAuth duplicate parameter connection failures, bogus column default values from the new JDBC driver, missing primary key constraints in generated changelogs, and Lakebase/PostgreSQL-protocol connectivity when the Databricks extension JAR is present.
Oracle Multi-Schema Support – Restored unique constraint backing indexes in multi-schema snapshots and removed hardcoded source schema names from function-based indexes.
Snowflake Change Type Functionality – Fixed an issue where TABLE- and SEQUENCE-related change types did not maintain backward compatibility in YAML and JSON formatted changelogs.
Improved Security – Addressed HIGH-severity jackson-core CVE (GHSA-72hv-8253-57qq) across core and extension modules, blocking customer adoption due to failing security scans.
Resolved Security Vulnerability Report
CVE Summary
Critical: 0 | High: 5 | Customer Impact: None
CVE ID | CVSS Score | Library | Customer Impact |
GHSA-72hv-8253-57qq | High | com.fasterxml.jackson.core / jackson-core | Description: The non-blocking (async) JSON parser in jackson-core bypasses the `maxNumberLength` constraint (default: 1,000 characters), allowing arbitrarily long numbers in a JSON payload to cause memory and CPU exhaustion, resulting in a denial of service. Attack Vector: Network-based, via JSON payload containing oversized numbers sent to endpoints using the async parser. Impact: Availability impact — denial of service via resource exhaustion. No confidentiality or integrity impact. Weakness: CWE-770 — Allocation of Resources Without Limits or Throttling. Exploitability: Requires targeting an endpoint that uses jackson-core's non-blocking async parser specifically. Available Patched Versions: 2.18.6, 2.21.1, 3.1.0. Required Action: Upgrade to the next Liquibase release. Customer Impact: None. No Liquibase module uses the non-blocking async parser. All Jackson usage across Liquibase core and extensions goes through synchronous APIs. The affected jackson-core copies are transitive dependencies pulled in by upstream SDKs (Azure, Cassandra, Couchbase) and the vulnerable feature is never invoked. |
CVE-2026-25679
| High | Go stdlib / net/url
| Description: Incorrect parsing of IPv6 host literals in net/url. Parse insufficiently validated the host/authority component and accepted invalid URLs. Attack Vector: Network-based, no authentication required, no user interaction. Impact: Availability impact — denial of service. No confidentiality or integrity impact. Exploitability: Exploitable over the network with no privileges or user interaction required. Available Patched Versions: Go 1.25.8, 1.26.1. Customer Impact: LPM ships with Liquibase, so the fix will be included automatically in the next Liquibase release. |
CVE-2025-55163 | High | io.netty / netty-codec-http2 | Description: A server-side HTTP/2 DoS ("MadeYouReset"). An attacker sends malformed HTTP/2 control frames (zero-increment WINDOW_UPDATE, HEADERS/DATA on closed streams, or malformed PRIORITY frames) that trigger server-initiated RST_STREAM responses. Because reset streams are not counted against SETTINGS_MAX_CONCURRENT_STREAMS, the server continues processing canceled work, allowing an attacker to drive unbounded concurrency from a single connection and exhaust server resources. Attack Vector: Network-based, no authentication or user interaction required. Targets any public-facing HTTP/2 server endpoint. Impact: Availability impact — denial of service via resource exhaustion. No confidentiality or integrity impact. Weakness: CWE-770 — Allocation of Resources Without Limits or Throttling. Exploitability: Requires targeting an HTTP/2 server endpoint. Available Patched Versions: 4.1.124.Final, 4.2.4.Final. Required Action: Upgrade to the next Liquibase release. Customer Impact: None. Liquibase does not operate as an HTTP/2 server. The affected Netty libraries are transitive dependencies from the Cassandra and Azure commercial extensions, and the vulnerable server-side code path is never exposed. |
CVE-2025-58057 | High | io.netty / netty-codec (BrotliDecoder) | Description: A decompression zip-bomb DoS in Netty's BrotliDecoder (and other decompression decoders). The decoder lacks an upper bound on decompression iterations, processing data in 64 KB chunks appended to an output list held entirely in memory. A crafted compressed payload causes unbounded heap growth until an OutOfMemoryError crashes the service. Attack Vector: Network-based, no authentication required. An attacker sends a small, highly-compressed payload to any Netty endpoint accepting compressed HTTP bodies from untrusted clients. Impact: Availability impact — memory exhaustion / OOM crash. No confidentiality or integrity impact. Weakness: CWE-409 — Improper Handling of Highly Compressed Data (Zip Bomb). Exploitability: Requires the target to accept Brotli-compressed (or other affected codec) request bodies from untrusted network clients. Available Patched Versions: 4.1.125.Final, 4.2.5.Final. Required Action: Upgrade to the next Liquibase release. Customer Impact: None. Liquibase does not accept compressed HTTP payloads from untrusted clients. The affected Netty libraries are transitive dependencies from the Cassandra and Azure extensions, and the vulnerable decompression path is not invoked. |
CVE-2025-58056 | High | io.netty / netty-codec-http (HttpObjectDecoder) | Description: An HTTP request smuggling vulnerability in Netty's HttpObjectDecoder. The decoder incorrectly accepts a bare LF as a valid chunk-size line terminator (RFC 9112 requires CRLF). When Netty is deployed behind a proxy that enforces strict CRLF parsing, a desynchronization occurs, allowing an attacker to smuggle a hidden second request past the proxy's access controls. Attack Vector: Network-based, no authentication required. Exploitable only when Netty acts as an HTTP backend behind a reverse proxy or load balancer, enforcing strict CRLF termination. Impact: Integrity impact — HTTP request smuggling enabling cache poisoning, security control bypass, and unauthorized backend access. No availability or confidentiality impact. Weakness: CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). Exploitability: Requires Netty to be serving as a backend HTTP server behind a reverse proxy. Available Patched Versions: 4.1.125.Final, 4.2.5.Final. Required Action: Upgrade to the next Liquibase release. Customer Impact: None. Liquibase is not deployed as an HTTP backend behind a reverse proxy. The affected Netty libraries are transitive dependencies of the Cassandra and Azure extensions, and the server-side vulnerability does not apply. |
CVE-2025-67735 | Medium | io.netty / netty-codec-http (HttpRequestEncoder) | Description: A CRLF injection vulnerability in Netty's HttpRequestEncoder. The encoder writes the request URI into the HTTP request line without sanitizing CRLF characters, allowing injected sequences to add arbitrary HTTP headers or split the request and smuggle it against downstream services. Attack Vector: Network-based, no authentication or user interaction required. Requires attacker-controlled input to reach HttpRequestEncoder as the URI. Impact: Low confidentiality and low integrity impact — allows HTTP header injection or request manipulation. No availability impact. Weakness: CWE-93 — Improper Neutralization of CRLF Sequences (CRLF Injection). Exploitability: Requires attacker-controlled input to reach Netty's HttpRequestEncoder. In Liquibase's use case, connection URIs are configured by trusted administrators, not untrusted end-users. Available Patched Versions: 4.1.129.Final, 4.2.8.Final. Required Action: Upgrade to the next Liquibase release. Customer Impact: None. Liquibase connection URIs are configured by trusted administrators and are not supplied by untrusted end-users. The affected Netty libraries are transitive dependencies from the Cassandra and Azure extensions, and no untrusted input reaches HttpRequestEncoder in Liquibase's usage. |
Changelog
(DAT-22271, DAT-22304, DAT-22305, DAT-22306, DAT-22312, DAT-22313) SQL Server CLR object snapshotting now generates valid, replayable DDL
Several issues were identified and resolved, in which generate-changelog and snapshot produced invalid SQL when targeting SQL Server databases that contain CLR (Common Language Runtime) objects.
(DAT-22359) MSSQL trigger snapshots now correctly capture the usesQuotedIdentifier setting
The usesQuotedIdentifier attribute was no longer being captured for SQL Server triggers during snapshot operations. This has been corrected, ensuring trigger snapshots include complete and accurate metadata.
(INT-1868) Connecting to Databricks with OAuth no longer fails
This regression has been fixed, restoring the behavior and allowing Databricks connections to succeed as expected.
(DAT-22449) Primary key constraints are no longer missing from generated changelogs for Databricks tables This regression has been fixed, ensuring round-trip deployments succeed and foreign key relationships are captured correctly in generated changelogs.
(DAT-22453) Databricks column default values are no longer incorrectly set to their type name
A Databricks column was assigned an incorrect default value equal to its type name (e.g., defaultValue="STRING", defaultValueComputed="INT"), resulting in incorrect snapshots and changelogs that could fail or create the wrong schema during deployment.
(INT-1877) Liquibase fails to connect to Lakebase commercial JAR is present
Fixed a connection failure that was happening only when the liquibase-commercial-databricks.jar was present in the Liquibase installation.
(DAT-22368) Multi-schema Oracle snapshots fail on non-default schemas
Fixed a 5.1.0 regression where multi-schema Oracle environments produced incomplete snapshots, false diff results, and changelogs that could create duplicate indexes on replay. Single-schema operations were unaffected.
(DAT-22417) Function-based index hardcodes the source schema name in Oracle
Fixed an issue where generate-changelog hardcoded the source schema name in Oracle function-based index expressions (e.g., "ORA_SRC_8"."FN_UPPER_NAME"), causing deployment failures with ORA-00942 on any target schema with a different name. All function-based indexes referencing user-defined functions were affected.
(INT-1941) New Snowflake change types conflict with legacy change types
The Liquibase View and Sequencechangetypes are not compatible for Snowflake users in Liquibase Secure 5.1 using YAML or JSON changetype formats. If you’re connecting to a Snowflake database, Liquibase automatically detects that you are using Snowflake and determines whether to use the expanded change type feature set. In JSON and YAML cases, it erroneously assumed the expanded feature set in all cases. This breaks backwards compatibility with the Liquibase standard changetype behavior. For example, if you are connected to a Snowflake database and use createView, Liquibase will detect that you are using Snowflake and use the Snowflake createView change type instead of the generic. This does not affect users who use XML. In 5.1.1, we updated this functionality to ensure that Snowflake-specific View and Sequence change types are backward compatible with the generic Liquibase View and Sequence change types.
(DAT-22521) Supply chain security enhancement
Liquibase Secure distribution archives are now GPG-signed and include SHA256, MD5, and SHA1 checksums.