Apache Pulsar vulnerabilities

20 CVEs affecting Apache Pulsar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-30677, published 2025-04-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-27317, published 2024-03-12. Critical severity, CVSS 9.9. EPSS: 56.9% chance of exploitation in the next 30 days. In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is…
CVE-2021-22160, published 2021-05-26. Critical severity, CVSS 9.8. EPSS: 52.9% chance of exploitation in the next 30 days. If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to…
CVE-2024-27135, published 2024-03-12. Critical severity, CVSS 9.9. EPSS: 6% chance of exploitation in the next 30 days. Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for…
CVE-2024-27894, published 2024-03-12. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include…
CVE-2022-34321, published 2024-03-12. High severity, CVSS 8.2. EPSS: 1.8% chance of exploitation in the next 30 days. Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics…
CVE-2021-41571, published 2022-02-01. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a…
CVE-2024-28098, published 2024-03-12. Medium severity, CVSS 5.4. EPSS: 1.7% chance of exploitation in the next 30 days. The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations…
CVE-2022-24280, published 2022-09-23. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache…
CVE-2024-29834, published 2024-04-02. Medium severity, CVSS 6.4. EPSS: 1.4% chance of exploitation in the next 30 days. This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These…
CVE-2023-37544, published 2023-12-20. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This issue affects Apache Pulsar WebSocket…

Latest

CVE-2025-30677, published 2025-04-09. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive…
CVE-2023-51437, published 2024-02-07. High severity, CVSS 7.4. EPSS: 0.8% chance of exploitation in the next 30 days. Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended…
CVE-2023-37579, published 2023-07-12. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. Any authenticated user can retrieve a…