PU
Product
Pulsar
20
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 10Low 0
Watch
Add Pulsar to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-27317 | 9.9 | Mar 12 | In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files Affected: 2.4.0 before 2.10.6; 2.11.0 before 2.11.4; 3.0.0 before 3.0.3; 3.1.0 before 3.1.3; 3.2.0 |
| CVE-2024-27135 | 9.9 | Mar 12 | Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the… Affected: 2.4.0 before 2.10.6; 2.11.0 before 2.11.4; 3.0.0 before 3.0.3; 3.1.0 before 3.1.3; 3.2.0 |
| CVE-2021-22160 | 9.8 | May 26 | If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented… Affected: before 2.7.1 |
| CVE-2024-27894 | 8.8 | Mar 12 | The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL Affected: 2.4.0 before 2.10.6; 2.11.0 before 2.11.4; 3.0.0 before 3.0.3; 3.1.0 before 3.1.3; 3.2.0 |
| CVE-2023-30429 | 8.8 | Jul 12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Affected: before 2.10.4; 2.11.0; 2.11.0; 2.11.0 |
| CVE-2022-34321 | 8.2 | Mar 12 | Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication Affected: 2.6.0 before 2.10.6; 2.11.0 before 2.11.3; 3.0.0 before 3.0.2; 3.1.0 |
| CVE-2023-30428 | 8.1 | Jul 12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message… Affected: 2.9.0 through 2.9.5; 2.10.0 before 2.10.4; 2.11.0; 2.11.0; 2.11.0 |
| CVE-2022-33684 | 8.1 | Nov 4 | Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation Affected: through 2.6.4; 2.7.0 before 2.7.5; 2.8.0 before 2.8.4; 2.9.0 before 2.9.3; 2.10.0 before 2.10.2 |
| CVE-2023-37544 | 7.5 | Dec 20 | Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication Affected: before 2.10.5; 2.11.0 before 2.11.2; 3.0.0 |
| CVE-2023-51437 | 7.4 | Feb 7 | Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification Affected: through 2.10.5; 2.11.0 before 2.11.3; 3.0.0 before 3.0.2; 3.1.0; 3.1.0 |
| CVE-2025-30677 | 6.5 | Apr 9 | Apache Pulsar contains multiple connectors for integrating with Apache Kafka Affected: 2.3.0 before 3.0.11; 3.3.0 before 3.3.6; 4.0.0 before 4.0.4 |
| CVE-2023-37579 | 6.5 | Jul 12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker Affected: before 2.10.4; 2.11.0; 2.11.0; 2.11.0 |
| CVE-2023-31007 | 6.5 | Jul 12 | Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the… Affected: before 2.9.5; 2.10.0 through 2.10.3; 2.11.0; 2.11.0; 2.11.0 |
| CVE-2022-24280 | 6.5 | Sep 23 | Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address Affected: through 2.6.4; 2.7.0 before 2.7.5; 2.8.0 before 2.8.3; 2.9.0 before 2.9.2 |
| CVE-2021-41571 | 6.5 | Feb 1 | In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user Affected: 2.6.0 before 2.6.4; 2.7.0 before 2.7.3; 2.8.0 |
| CVE-2024-29834 | 6.4 | Apr 2 | This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering… Affected: 2.7.1 through 2.10.6; 2.11.0 through 2.11.4; 3.0.0 before 3.0.4; 3.1.0 through 3.1.3; 3.2.0 before 3.2.2 |
| CVE-2022-33683 | 5.9 | Sep 23 | Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via… Affected: before 2.7.5; 2.8.0 before 2.8.4; 2.9.0 before 2.9.3; 2.10.0 |
| CVE-2022-33682 | 5.9 | Sep 23 | TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar… Affected: before 2.7.5; 2.8.0 before 2.8.4; 2.9.0 before 2.9.3; 2.10.0 |
| CVE-2022-33681 | 5.9 | Sep 23 | Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack Affected: before 2.7.5; 2.8.0 before 2.8.4; 2.9.0 before 2.9.3; 2.10.0 |
| CVE-2024-28098 | 5.4 | Mar 12 | The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings Affected: 2.7.1 before 2.10.6; 2.11.0 before 2.11.4; 3.0.0 before 3.0.3; 3.1.0 before 3.1.3; 3.2.0 |
Showing 20