Skip to main content
Tungsten Clustering

Tungsten Clustering 7.2.2

Build: 19
Release Date: 27 Jul 2026
Release 7.2.2 contains a number of key bug fixes and improvements.

Behavior Changes (1)

The following changes may affect existing scripts and integration tools. Any scripts or environment which make use of these tools should check and update for the new configuration:

Installation and Deployment (1)

  • Upgraded 3rd party libraries to remove critical and high severity CVEs. The full list is as follows:

    • zookeeper 3.4.14 → 3.9.4 — CVE-2023-44981 (SASL Quorum auth bypass)
    • log4j-api / log4j-core 2.23.1 → 2.25.3 (consolidated) — keeps log4j current; no known critical post-2.17 CVEs but stays ahead
    • commons-text 1.9 → 1.12.0 / 1.13.0 — CVE-2022-42889 (Text4Shell)
    • commons-compress 1.21 → 1.27.1 — CVE-2024-25710, CVE-2024-26308 (DoS via crafted archives)
    • commons-configuration2 (replaced commons-configuration 1.9) → 2.11.0 — CVE-2024-29131, CVE-2024-29133
    • commons-io 2.11.0 → 2.18.0 — CVE-2024-47554
    • jackson-databind 2.13.0 → 2.17.2 / 2.18.2 — CVE-2022-42003, CVE-2022-42004
    • guava 31.0.1-jre → 33.4.0-jre — CVE-2023-2976
    • h2 1.4.199 → 2.3.232 — CVE-2021-23463, CVE-2022-23221
    • postgresql JDBC 42.5.4 → 42.7.7 — CVE-2024-1597, CVE-2022-31197, CVE-2022-26520
    • dom4j 1.6.1 → 2.1.4 — CVE-2018-1000632, CVE-2020-10683
    • xstream 1.4.20 → 1.4.21 — CVE-2024-47072
    • velocity-engine-core 2.3 → 2.4.1 — CVE-2020-13936 era cleanup
    • kafka-clients 0.10.2.2 → 3.9.1 — CVE-2023-25194, CVE-2024-27309
    • junit 4.12 → 4.13.2 — CVE-2020-15250 (temp-dir disclosure; test-time only)
    • netty / xz xz 1.8 → 1.9 — CVE-2022-26259 era
    • protobuf-java 2.6.1 → 4.33.5 — CVE-2024-7254, CVE-2022-3171

    The following libraries are no longer required and have been removed entirely:

    • bonecp 0.8.0 — abandoned upstream
    • derby 10.12.1.1
    • postgresql 9.0-801.jdbc3 and 9.3-1102.jdbc4 — many old PG-JDBC CVEs gone
    • sqljdbc4 (replaced by mssql-jdbc 12.10.0) — CVE-2022-23270 era
    Issues: CT-2752, CT-2677, CT-2681

Improvements, new features and functionality (6)

Core Replicator (1)

  • Improved logging performance of "UPDATE or DELETE statement did not process any row." messages.

    While these messages should be rare, performance could decrease when displaying a lot of rows. Also, the message format was changed when policy is set to WARN, previously:

    Event seqno=3726720187/fragno=0 : UPDATE or DELETE statement did not process any row. 
        DELETE FROM `someSchema`.`someTable` WHERE `id` = ?  
        Arguments: - ROW# = 0 - KEY(index=1 name=id type=4 [INTEGER] length=8 unsigned=true blob=false desc=BIGINT UNSIGNED) (size = 3) = 123

    Now, only the first line will be displayed by default:

    Event seqno=3726720187/fragno=0 : UPDATE or DELETE statement did not process any row.

    The detailed view of the statement / values that did not change the database will be logged only if log4j is set in DEBUG

    Issue: CT-2733

Connector (2)

  • Connector audit log now records inbound client TLS status via a new tls.in=true|false field (MySQL proxy mode), logged once the client authenticates.

    The audit log is off by default. The tls.in is found on the "Client authentication passed" entry, emitted by the AppConnections logger — so to enable that one:

    In tungsten-connector/conf/log4j.properties, flip the level from OFF to INFO:

    # AppConnections log entries for each client application connect and disconnect
    logger.AppConnections.level=INFO
    Issue: CT-2821
  • Default cipher list updated so TLSv1.3 protocol can be enabled (JDK 8u261 onwards)
    Issue: CT-2814

Security (1)

  • Updated log4j libraries to mitigate security threats found in earlier versions. Note that these issues do not affect Tungsten installations when configured with the default log4j properties files.
    Issue: CT-2674

Manager (1)

Documentation (1)

  • All documentation URL references in help text output and template files have been updated.
    Issue: CT-2686

Bug Fixes (1)

Connector (1)

  • Fixed an issue in multi-site configurations where a site recovery would cause a brief application disconnection on the local site.
    Issue: CT-2693