be.wegenenverkeer:rxhttpclient (2.0.1), be.wegenenverkeer:rxhttpclient-fs2_2.13 (2.0.1) +103 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=2.14.5, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.14.5, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =4.0.11.0 and more Source cves: CVE-2026-85717 Source advisory: GHSA-F8M2-889X-VW4X...

com.ascentstream.pulsar:pulsar-bookkeeper-prometheus-metrics-provider (4.0.11.0), com.ascentstream.pulsar:pulsar-broker (4.0.11.0) +88 more potentially affected by CVE-2026-10050 via org.eclipse.jetty.ee8:jetty-ee8-security (>=12.1.0, <=12.1.9)

org.eclipse.jetty.ee8:jetty-ee8-security MAVEN version =12.1.0, =5.0.1, =5.0.3-beta and more Source cves: CVE-2026-10050 Source advisory: OSV:GHSA-2FVJ-HGJ9-J2GR...

com.ascentstream.pulsar:pulsar-broker (>=2.10.7.8, <=2.10.7.12), com.ascentstream.pulsar:pulsar-broker-auth-athenz (>=2.10.7.8, <=2.10.7.12) +183 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.9.16)

io.vertx:vertx-core MAVEN version 3.9.16 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - com.ascentstream.pulsar:pulsar-broker =2.10.7.8, =2.10.7.8, =2.10.7.8, =2.10.7.8, =2.10.7.8, =0.12, =0.20, =2.0.0-rc6,...

com.ascentstream.pulsar:pulsar-broker (>=2.10.7.8, <=2.10.7.12), com.ascentstream.pulsar:pulsar-broker-auth-athenz (>=2.10.7.8, <=2.10.7.12) +58 more potentially affected by CVE-2025-11965 via io.vertx:vertx-web (3.9.16)

io.vertx:vertx-web MAVEN version 3.9.16 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - com.ascentstream.pulsar:pulsar-broker =2.10.7.8, =2.10.7.8, =2.10.7.8, =2.10.7.8, =2.10.7.8, =2.0.0-rc6, =2.0.5 -...

EUVD-2022-6863

Malicious code in bioql PyPI...

com.datastax.oss:pulsar-jms-filters (>=4.0.0, <=4.0.1), io.github.yangl:pulsar-msg-filter-plugin (3.0) +5 more potentially affected by CVE-2024-29834 via org.apache.pulsar:pulsar-broker (>=3.0.0, <=3.0.3)

org.apache.pulsar:pulsar-broker MAVEN version =3.0.0, =4.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.3 Source cves: CVE-2024-29834 Source advisory: GHSA-7MG2-6C6V-342R...

org.apache.pulsar:pulsar-broker-auth-athenz (>=3.1.0, <=3.1.3), org.apache.pulsar:pulsar-broker-auth-sasl (>=3.1.0, <=3.1.3) +2 more potentially affected by CVE-2024-29834 via org.apache.pulsar:pulsar-broker (>=3.1.0, <=3.1.3)

org.apache.pulsar:pulsar-broker MAVEN version =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.3 Source cves: CVE-2024-29834 Source advisory: GHSA-7MG2-6C6V-342R...

com.datastax.oss:pulsar-jms-filters (>=4.0.0, <=4.0.1), io.github.yangl:pulsar-msg-filter-plugin (3.0) +5 more potentially affected by CVE-2024-29834 via org.apache.pulsar:pulsar-broker (>=3.0.0, <=3.0.3)

org.apache.pulsar:pulsar-broker MAVEN version =3.0.0, =4.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.3 Source cves: CVE-2024-29834 Source advisory: OSV:GHSA-7MG2-6C6V-342R...

org.apache.pulsar:pulsar-broker-auth-athenz (>=3.2.0, <=3.2.1), org.apache.pulsar:pulsar-broker-auth-sasl (>=3.2.0, <=3.2.1) +2 more potentially affected by CVE-2024-29834 via org.apache.pulsar:pulsar-broker (>=3.2.0, <=3.2.1)

org.apache.pulsar:pulsar-broker MAVEN version =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.1 Source cves: CVE-2024-29834 Source advisory: GHSA-7MG2-6C6V-342R...

co.macrometa.c8streams.handlers:kop (>=2.7.1.5, <=2.7.1.6), com.clever-cloud:biscuit-pulsar (>=2.2.2, <=3.2.1) +8 more potentially affected by CVE-2024-29834 via org.apache.pulsar:pulsar-broker (>=2.7.1, <=2.10.6)

org.apache.pulsar:pulsar-broker MAVEN version =2.7.1, =2.7.1.5, =2.2.2, =3.1.7, =0.0.1, =2.7.1, =2.7.1, =2.7.1, =2.7.1, =2.7.1, =1.0.0, =1.1.0 Source cves: CVE-2024-29834 Source advisory: GHSA-7MG2-6C6V-342R...

org.apache.pulsar:pulsar-broker-auth-athenz (>=3.2.0, <=3.2.1), org.apache.pulsar:pulsar-broker-auth-sasl (>=3.2.0, <=3.2.1) +2 more potentially affected by CVE-2024-29834 via org.apache.pulsar:pulsar-broker (>=3.2.0, <=3.2.1)

org.apache.pulsar:pulsar-broker MAVEN version =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.1 Source cves: CVE-2024-29834 Source advisory: MEND:CVE-2024-29834...

cn.aradin:aradin-cluster-zookeeper-starter (>=1.1.1, <=1.1.2), cn.aradin:aradin-lucene-solr-starter (>=1.1.1, <=1.1.2) +526 more potentially affected by CVE-2024-23944 via org.apache.zookeeper:zookeeper (>=3.9.0, <=3.9.1)

org.apache.zookeeper:zookeeper MAVEN version =3.9.0, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =2.1.1, =15.1-release, =15.0-release, =2.03-release, =3.3.0.4.0.6, =3.3.0.4.0.5, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.10 and more Source cves: CVE-2024-23944 Source advisory:...

CVE-2024-27317

A path traversal vulnerability was found in Apache Pulsar. Pulsar allows authenticated users to upload functions to be run by the Pulsar Function Workers, these codes are in the format of a ZIP file. When extracting the uploaded ZIP file Pulsar fails to properly validate the file names contained ...

CVE-2024-27135

A vulnerability in Apache Pulsar allows a malicious authenticated user to perform remote arbitrary code execution on Pulsar's function worker. A successful attack impacts the data integrity and confidentiality, as well as system availability. Pulsar broker is also susceptible to this attack when...

CVE-2024-27894

The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...

CVE-2024-27317 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in th...

CVE-2024-27317: Improper Limitation of a Pathname to a Restricted Directory

In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in th...

CVE-2024-27894: Improper Input Validation

The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...

CVE-2024-27135: Improper Control of Dynamically-Managed Code Resources

Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is...

CVE-2023-51437

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...