Patch 4.5.5 (2026.11.3.3)

Enhancements:

• Updated Databricks Zerobus connections to version 1.6.
• Optimized Custom Conditions to no longer access the SQLite cache if the expression doesn’t use lastValue or lastReturnValue.

Fixes:

• Fixed an issue where MQTT Client messages with QoS 1 or 2 that timed out were never removed from the in-flight queue. This could cause the in-flight queue to fill over time and prevent new messages from being sent.
• Fixed a race condition in the PI Agent where multiple PI Connections that experience request timeouts could cause a failure to reconnect to the PI System.
• Fixed an issue where some browser security or DLP extensions could break reference panel drag-and-drop.
• Fixed an issue where, after a high availability failover, the newly promoted node did not reconnect to its central hub, leaving the remote hub shown as disconnected until the node was restarted.

Breaking Changes:

• The MySQL JDBC driver is no longer included with the Intelligence Hub due to licensing restrictions. MySQL connections, and JDBC Driver connections that use MySQL, will fail to connect after upgrading until the driver is downloaded, copied into the runtime/lib directory, and the runtime is restarted.

Security Patch Updates

• CVE-2026-118258: Defect that allows & and = characters in the language value to inject additional query parameters when the locale load path places the language in the query string.
• CVE-2026-115730: Defect that allows a namespace value starting with / to form a protocol-relative locale load path, bypassing an earlier fix and enabling requests to an external host.

• CVE-2026-59171: Defect that allows crafted input to trigger uncontrolled resource allocation, leading to denial of service.
• CVE-2026-107314: Defect that causes the PostgreSQL driver to accept cleartext password authentication when the requireAuth setting excludes every known authentication method, instead of rejecting the connection.
• CVE-2025-53864: Defect that allows a deeply nested JSON object in a JWT claim set to trigger uncontrolled recursion, leading to denial of service.
• CVE-2026-47843: Defect that could cause a client to reuse a DNS resolver that was configured for a different client.
• CVE-2026-47845: Defect that could cause the HTTP server to evaluate the wrong remote IP address when HAProxy Protocol is enabled.
• CVE-2026-47848: Defect that could leak credentials when a WebSocket handshake is redirected to a different origin and the client is configured to follow redirects.
• CVE-2026-47874: Defect that allows HTTP/1.1 pipelined requests over a single connection to consume excessive memory, leading to denial of service.
• CVE-2026-47857: Defect that allows the windowTimeout operator with fair backpressure enabled to be driven into a denial of service condition.
• CVE-2026-47863: Defect that allows the bufferTimeout operator with fair backpressure enabled to be driven into a denial of service condition.
• CVE-2026-110985: Defect that causes a Kafka broker using SASL/OAUTHBEARER with the default validator and no JWKS endpoint to accept JWTs without verifying their signature, enabling forged tokens.
• CVE-2026-93451: Defect that allows a declared uncompressed length that is not a multiple of the element size to write past the end of the result array during typed-array decompression.
• CVE-2026-108104: Defect that allows framed data with a large declared chunk length to cause pooled buffers to be released twice, exposing or overwriting other streams' decompressed data.
• CVE-2026-108106: Defect that allows a crafted uncompressed length in compressed data to force an allocation of up to 2 GB, leading to denial of service.
• CVE-2026-110879: Defect in jackson-databind that could allow crafted JSON input to compromise deserialization.
• CVE-2026-93879: Defect in hibernate-validator that could allow crafted input to bypass or abuse bean validation.

• CVE-2026-106451: Defect that allows another local user with write access to the shared temporary directory to replace the extracted native LZ4 library before it is loaded, enabling code execution.