Pulsar (Apache) - vulnerabilities (CVEs)

20 CVEs, 0 in the last 30 days, 229 known versions, newest CVE from 2025-04-09. Vendor: Apache.

CVEs of Pulsar

CVE-2025-30677 - CVSS 6.5 (medium), 2025-04-09: Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect…
CVE-2024-29834 - CVSS 6.4 (medium), 2024-04-02: This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading…
CVE-2024-28098 - CVSS 6.4 (medium), 2024-03-12: The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading…
CVE-2024-27317 - CVSS 9.9 (critical), 2024-03-12: In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions…
CVE-2024-27135 - CVSS 9.9 (critical), 2024-03-12: Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker,…
CVE-2022-34321 - CVSS 8.2 (high), 2024-03-12: Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable…
CVE-2024-27894 - CVSS 8.8 (high), 2024-03-12: The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a…
CVE-2023-51437 - CVSS 7.4 (high), 2024-02-07: Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass…
CVE-2023-37544 - CVSS 7.5 (high), 2023-12-20: Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This…
CVE-2023-37579 - CVSS 8.2 (high), 2023-07-12: Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and…
CVE-2023-31007 - CVSS 6.5 (medium), 2023-07-12: Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication…
CVE-2023-30429 - CVSS 9.6 (critical), 2023-07-12: Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client…
CVE-2023-30428 - CVSS 8.2 (high), 2023-07-12: Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header…
CVE-2022-33684 - CVSS 8.1 (high), 2022-11-04: The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when…
CVE-2022-33681 - CVSS 5.9 (medium), 2022-09-23: Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from…
CVE-2022-24280 - CVSS 6.5 (medium), 2022-09-23: Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the…
CVE-2022-33683 - CVSS 5.9 (medium), 2022-09-23: Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is…
CVE-2022-33682 - CVSS 5.9 (medium), 2022-09-23: TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java…
CVE-2021-41571 - CVSS 6.5 (medium), 2022-02-01: In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API…
CVE-2021-22160 - CVSS 9.8 (critical), 2021-05-26: If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the…