Apache Software Foundation Apache Pulsar vulnerabilities
30 known vulnerabilities affecting apache_software_foundation/apache_pulsar.
Total CVEs
30
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL4HIGH9MEDIUM12LOW5
Vulnerabilities
Page 2 of 2
CVE-2022-33681P3MEDIUMCVSS 5.9v2.10.0≥ 2.7, ≤ 2.7.4+3 more2022-09-23
CVE-2022-33681 [MEDIUM] CWE-295 CVE-2022-33681: Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vu
Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication data is sent before verifying the server’s TLS certifi
nvd
CVE-2022-24280P3MEDIUMCVSS 6.5≥ 2.7, ≤ 2.7.4≥ 2.8, ≤ 2.8.2+2 more2022-09-23
CVE-2022-24280 [MEDIUM] CWE-20 CVE-2022-24280: Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to ma
Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to open TCP/IP connections to any IP address and port that the Pulsar Proxy can connect to. An at
nvd
CVE-2022-33683P4MEDIUMCVSS 5.9v2.10.0≥ 2.7, ≤ 2.7.4+3 more2022-09-23
CVE-2022-33683 [MEDIUM] CWE-295 CVE-2022-33683: Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer T
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, confi
nvd
CVE-2024-28098P4MEDIUMCVSS 5.4≥ 2.7.1, < 2.10.6≥ 2.11.0, < 2.11.4+3 more2024-03-12
CVE-2024-28098 [MEDIUM] CWE-863 CVE-2024-28098: The vulnerability allows authenticated users with only produce or consume permissions to modify topi
The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role.
This issue affects Apache Pulsar versions from 2.7.1 to 2.10.5, from 2.11.0 to
nvd
CVE-2022-33682P4MEDIUMCVSS 5.9v2.10.0≥ 2.7, ≤ 2.7.4+3 more2022-09-23
CVE-2022-33682 [MEDIUM] CWE-295 CVE-2022-33682: TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's
TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle attacks, which could leak credentials, configuration data
nvd
CVE-2026-105932P4LOWCVSS 2.3≥ 3.3.0, < 4.0.14≥ 4.1.0, < 4.2.52026-10-21
CVE-2026-105932 [LOW] CWE-862 CVE-2026-105932: The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level e
The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints check that the caller is authorized for the entry filters topic policy operation. The corresponding endpoints for non-persistent topics (/admin/v2/non-persistent/{tenant}/{namespace}/
nvd
CVE-2026-105931P4LOWCVSS 2.3≥ 2.8.0, < 4.0.14≥ 4.1.0, < 4.2.52026-10-21
CVE-2026-105931 [LOW] CWE-862 CVE-2026-105931: The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions.
The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transaction coordinator. They do not check whether the caller is
nvd
CVE-2026-105938P4LOWCVSS 2.3≥ 2.8.0, < 4.0.14≥ 4.1.0, < 4.2.52026-10-21
CVE-2026-105938 [LOW] CWE-863 CVE-2026-105938: Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix sub
Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles. Topic-level subscription operations, such as consuming, skipping messages, resetting a cursor
nvd
CVE-2026-105927P4LOWCVSS 2.3≥ 2.3.0, < 4.0.14≥ 4.1.0, < 4.2.52026-10-21
CVE-2026-105927 [LOW] CWE-863 CVE-2026-105927: The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy th
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. When authorization is enabled, the WebSocket service check
nvd
CVE-2026-105933P4LOWCVSS 2.3≥ 1.22.0-incubating, < 4.0.14≥ 4.1.0, < 4.2.52026-10-21
CVE-2026-105933 [LOW] CWE-636 CVE-2026-105933: Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a n
Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace policy. When this policy is set, the broker rejects messages that are published without encryption.
When the broker loads a persistent topic, it reads the namespace policies and the topic-level pol
nvd
← Previous2 / 2