K000161775: Apache Pulsar vulnerability CVE-2026-41732

Security Advisory Description JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather tha...

GHSA-5X3R-WRVG-RP6Q vulnerabilities

Vulnerabilities for packages: flyway, sonarqube, apache-hop, camunda, grpc-java-fips, pinot, spark-kubernetes-operator, kafbat-ui, wavefront-proxy, management-api-for-apache-cassandra-5.0, camunda-zeebe, request-9047-keycloak-fips, hono, apache-nifi, opensearch, strimzi-kafka-operator-fips,...

CVE-2023-51437

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...

CVE-2022-33682

TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle...

CVE-2024-28098 Apache Pulsar: Improper Authorization For Topic-Level Policy Management

The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role. This issue affects Apache...

Apache Pulsar 安全漏洞

Apache Pulsar is the United States Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as one of the distributed message flow platform. The software supports multi-tenancy, persistent storage, multi-room cross-region data replication, and...

The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar lies in the improper verification of the cryptographic signature. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the cloud-based messaging and streaming communication platform Apache Pulsar is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information...