Apache Pulsar (Apache Software Foundation) - vulnerabilities (CVEs)

30 CVEs, 14 in the last 30 days, 5 known versions, newest CVE from 2026-10-21. Vendor: Apache Software Foundation.

CVEs of Apache Pulsar

• CVE-2026-105945 - CVSS 7.7 (high), 2026-10-21: The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider.…
• CVE-2026-105942 - CVSS 7.7 (high), 2026-10-21: When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the…
• CVE-2026-105938 - CVSS 2.3 (low), 2026-10-21: Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a…
• CVE-2026-105937 - CVSS 8.7 (high), 2026-10-21: Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is…
• CVE-2026-105936 - CVSS 5.3 (medium), 2026-10-21: The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker…
• CVE-2026-105935 - CVSS 4.9 (medium), 2026-10-21: The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's…
• CVE-2026-105934 - CVSS 7.2 (high), 2026-10-21: The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE…
• CVE-2026-105933 - CVSS 2.3 (low), 2026-10-21: Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace…
• CVE-2026-105932 - CVSS 2.3 (low), 2026-10-21: The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these…
• CVE-2026-105931 - CVSS 2.3 (low), 2026-10-21: The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most…
• CVE-2026-105930 - CVSS 6 (medium), 2026-10-21: When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management…
• CVE-2026-105927 - CVSS 2.3 (low), 2026-10-21: The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including…
• CVE-2026-105926 - CVSS 5.3 (medium), 2026-10-21: The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCreateSchema, which…
• CVE-2026-105869 - CVSS 9.2 (critical), 2026-10-21: Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is…
• CVE-2024-29834 - CVSS 6.4 (medium), 2024-04-02: This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading…
• CVE-2024-28098 - CVSS 6.4 (medium), 2024-03-12: The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading…
• CVE-2024-27135 - CVSS 9.9 (critical), 2024-03-12: Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker,…
• CVE-2022-34321 - CVSS 8.2 (high), 2024-03-12: Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable…
• CVE-2024-27894 - CVSS 8.8 (high), 2024-03-12: The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a…
• CVE-2024-27317 - CVSS 9.9 (critical), 2024-03-12: In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions…
• CVE-2023-51437 - CVSS 7.4 (high), 2024-02-07: Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass…
• CVE-2023-31007 - CVSS 6.5 (medium), 2023-07-12: Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication…
• CVE-2023-30429 - CVSS 9.6 (critical), 2023-07-12: Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client…
• CVE-2022-33684 - CVSS 8.1 (high), 2022-11-04: The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when…
• CVE-2022-33682 - CVSS 5.9 (medium), 2022-09-23: TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java…
• CVE-2022-33681 - CVSS 5.9 (medium), 2022-09-23: Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from…
• CVE-2022-24280 - CVSS 6.5 (medium), 2022-09-23: Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the…
• CVE-2022-33683 - CVSS 5.9 (medium), 2022-09-23: Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is…
• CVE-2021-41571 - CVSS 6.5 (medium), 2022-02-01: In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API…
• CVE-2021-22160 - CVSS 9.8 (critical), 2021-05-26: If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the…