Apache Pulsar Vulnerabilities by Version: CVEs for Pulsar 2.x, 3.x, 4.x and 5.0

The short answer

Pulsar 5.0.0, the first release of the next LTS line, came out on 5 October 2026, the same day as 4.0.14. The release policy gives 5.0 active support until 5 October 2028 and security support until 5 October 2029, and gives 4.0 LTS active support until 21 October 2026 and security support until 21 October 2027. Every other line is out of support: 4.2 ended on 24 September 2026, 4.1 on 8 March 2026, and 3.0 LTS lost security support on 2 May 2026. The Pulsar security page lists 20 CVEs, the most recent from April 2025, plus a set of expedited releases for the Avro flaw CVE-2024-47561. Fixes have reached some lines after their support ended, but 2.x, 3.1 and 3.2 are each missing at least two.

Pulsar release lines and their CVEs

Support dates are from the Pulsar release policy page. Each row lists the CVEs from the Pulsar security page, plus CVE-2024-47561, that name the line and have no fix on it.

The release policy says the project does not announce end of support separately, and may make ad hoc releases for older lines on a best-effort basis when a CVE is serious enough. That is how 2.10.6 and 2.11.4 came out in March 2024, eleven and two months after those lines ended, and how 3.3 got 3.3.2 and 3.3.6. None of that is guaranteed for the next CVE. For dates on every line, see the Apache Pulsar end-of-life chart.

Notable Pulsar CVEs by release line

CVSS is NVD's own score where NVD has scored the record. For CVE-2024-47561, which is in the Avro Java SDK that Pulsar bundles, NVD has no score of its own and the figure is the CVSS 3.1 score CISA-ADP added. Apache's own scores, as the CNA, often differ from NVD's: it scores the Function Worker CVEs 8.4 to 8.5 where NVD gives 9.9 for two of them. None of these CVEs is in CISA's Known Exploited Vulnerabilities catalogue.

Most of this list comes down to two features. The first is Pulsar Functions: CVE-2024-27135, CVE-2024-27317, CVE-2024-27894, CVE-2023-30429 and CVE-2023-37579 all need the Function Worker, either as a separate service or inside the broker with functionsWorkerEnabled=true, and a cluster that does not run Functions is not exposed to them. The second is multi-tenant authorization: CVE-2024-28098, CVE-2024-29834 and CVE-2023-30428 let a tenant with ordinary produce or consume rights act beyond them, which matters most where several teams share one cluster. CVE-2024-47561 is different, because Avro is in the Java client as well as the brokers, so applications need the newer client too.

What each line gets

Pulsar 5.0 LTS

5.0.0 is the newest release and the start of the next LTS line. The policy supports live upgrade and downgrade from one LTS to the next, so 4.0 to 5.0 is the planned path, while 3.x to 5.0 is not supported in one step.

Pulsar 4.0 LTS

4.0.14 carries every fix above that applies to 4.0, and 4.0.0 already shipped Avro 1.11.4. Active support ends on 21 October 2026, after which 4.0 gets security fixes only until 21 October 2027. See Apache Pulsar 4.0 end of life.

Pulsar 4.1 and 4.2

Feature releases get six months of support. No advisory names 4.1 or 4.2, but neither line will get the fix for the next CVE, so the move from either is to 5.0 or back onto the 4.0 LTS line.

Pulsar 3.3, 3.2 and 3.1

These feature lines ended in 2024. 3.3 received ad hoc releases with the fixes for CVE-2024-47561 and CVE-2025-30677, so 3.3.9 has every fix above. 3.2.4 and 3.1.3 do not: both still bundle the vulnerable Avro, and 3.1 also has no fix for CVE-2024-29834, whose advisory sends 3.1 users to 3.2.2. The policy allows live upgrade from 3.2 to 4.0.

Pulsar 3.0 LTS

3.0 lost security support on 2 May 2026. Its last release, 3.0.17, carries every fix above, so the reason to move is that the next CVE will not reach it. The live upgrade path is 3.0 to 4.0; see the Pulsar 3.0 to 4.0 upgrade guide and Apache Pulsar 3.0 end of life.

Pulsar 2.10, 2.11 and older

2.10.6 and 2.11.4 carry the March 2024 Function Worker and proxy fixes, but not the April 2024 fix for CVE-2024-29834, nor the Avro or Kafka connector fixes. The CVE-2023-51437 advisory, for the SASL token forgery, names no 2.10 fix and sends 2.10 users to 2.11.3 or later. 2.9 and older have none of the 2024 fixes, including the Function Worker remote code execution, and 2.8 and 2.9 also lack the WebSocket proxy fix. Before 3.0 the policy requires upgrading one feature version at a time, so getting from 2.10 to 3.0 means passing through 2.11. 2.x clusters also run on ZooKeeper; see ZooKeeper for Pulsar.

What to do on each line

• 5.0 and 4.0. Take each patch release, and plan the move from 4.0 to 5.0 before 4.0 security support ends in October 2027.
• 4.1 and 4.2. Move to 5.0.
• 3.x. Move to 4.0 with a live upgrade, then to 5.0. The policy's own examples include 3.0 to 4.0 and 3.2 to 4.0.
• 2.x. Upgrade feature by feature to 3.0, or take patched builds from a supplier that backports fixes. Until then, disable the Function Worker if you do not use Functions, keep the proxy and its admin endpoints off untrusted networks, and review which roles hold produce and consume rights across tenants.
• Every line. Upgrade the Pulsar Java client in applications to 3.0.7, 3.3.2, 4.0.0 or later for CVE-2024-47561, whatever version the brokers run.

Where OSSeva fits

OSSeva ships CVE-patched, GPG-signed Pulsar builds for 2.10.x, 2.11.x, 3.0.x, 3.1.x, 3.2.x and 4.0.x, with ZooKeeper dependency coverage included, delivered as Docker images and Helm charts. OSSeva backports fixes of this class to the end-of-life release lines it patches. They are available now on the Patch, Assure and Operate tiers. Assure adds a multi-tenant namespace isolation audit, a JWT and TLS authentication review and ZooKeeper to Oxia migration planning, and Operate adds 24/7 broker, bookie and ZooKeeper monitoring with a 15-minute P1 response and support for Pulsar Functions and IO connectors. See Apache Pulsar support.