Apache
Apache Pulsar: vulnerabilidades y CVE
Apache Pulsar tiene 20 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE20
Últimos 12 meses0
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-30677 | Media (6.3) | 0.72% | — | 9 abr 2025 | Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties… |
| CVE-2024-29834 | Media (6.4) | 1.4% | — | 2 abr 2024 | This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations… |
| CVE-2024-28098 | Media (5.4) | 1.7% | — | 12 mar 2024 | The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to… |
| CVE-2024-27894 | Alta (8.8) | 1.9% | — | 12 mar 2024 | The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and… |
| CVE-2024-27317 | Crítica (9.9) | 57% | — | 12 mar 2024 | In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could… |
| CVE-2024-27135 | Crítica (9.9) | 6.0% | — | 12 mar 2024 | Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided… |
| CVE-2022-34321 | Alta (8.2) | 1.8% | — | 12 mar 2024 | Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections,… |
| CVE-2023-51437 | Alta (7.4) | 0.76% | — | 7 feb 2024 | Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to… |
| CVE-2023-37544 | Alta (7.5) | 1.4% | — | 20 dic 2023 | Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through… |
| CVE-2023-37579 | Media (6.5) | 0.82% | — | 12 jul 2023 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. Any authenticated user can retrieve a source's… |
| CVE-2023-31007 | Media (6.5) | 1.0% | — | 12 jul 2023 | Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy… |
| CVE-2023-30429 | Alta (8.8) | 1.0% | — | 12 jul 2023 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client connects to the Pulsar Function Worker via the Pulsar Proxy… |
| CVE-2023-30428 | Alta (8.1) | 0.82% | — | 12 jul 2023 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin… |
| CVE-2022-33684 | Alta (8.1) | 0.74% | — | 4 nov 2022 | The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability… |
| CVE-2022-33683 | Media (5.9) | 0.68% | — | 23 sept 2022 | Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's… |
| CVE-2022-33682 | Media (5.9) | 0.71% | — | 23 sept 2022 | TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster… |
| CVE-2022-33681 | Media (5.9) | 0.69% | — | 23 sept 2022 | Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and… |
| CVE-2022-24280 | Media (6.5) | 1.4% | — | 23 sept 2022 | Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component… |
| CVE-2021-41571 | Media (6.5) | 1.7% | — | 1 feb 2022 | In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id.… |
| CVE-2021-22160 | Crítica (9.8) | 53% | — | 26 may 2021 | If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an… |