The CDS actor uses io.netty which is known to have several security vulnerabilities, sonatype-2020-0026:

• https://github.com/netty/netty/issues/9930
• https://github.com/netty/netty/issues/9938

From reading these, it appears that the issue can be addressed by configuring netty to use SSL via the SSLContext/SSLParameters.  Further investigation may prove that can't be done in policy-models or that it doesn't solve the issues.