OSSEVA FOR APACHE PULSAR
Apache Pulsar — patched, protected, operated.
Apache Pulsar is the multi-tenant, cloud-native messaging and streaming platform powering financial services and enterprise data pipelines globally. OSSeva provides CVE-patched builds, hardened configurations, and 24/7 managed operations for 2.10.x and 3.x.
Last reviewed
Trusted globally by enterprises
Why now
Commercial Pulsar support centres on vendor platforms
StreamNative, the main commercial Pulsar vendor, builds its offering around its own Pulsar platform and publishes no version-support policy for community Pulsar. DataStax Luna Streaming is now IBM Elite Support for Apache Pulsar, built on IBM's own 3.1 distribution. Teams running community Pulsar on their own clusters have few options for patches on the version they already run.
Pulsar's rapid release cadence creates EOL exposure
Apache Pulsar releases major versions frequently, with community support windows shorter than most enterprise upgrade cycles. Pulsar 2.10.x and 2.11.x are already past active community support, but remain in production at hundreds of enterprises.
ZooKeeper dependency creates compounded CVE risk
Older Pulsar versions depend heavily on ZooKeeper for metadata. ZooKeeper has its own CVE stream — OSSeva monitors and patches both Pulsar and its ZooKeeper dependency, closing a gap that community support leaves open.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 2.10.x(Full CVE coverage) | Extended | Clean |
| 2.11.x(Full CVE coverage) | Extended | Clean |
| 3.0.x(LTS, security support ended 2 May 2026 — OSSeva patched) | EOL | Clean |
| 3.1.x(Community EOL — OSSeva patched) | EOL | Clean |
| 3.2.x(Community EOL — OSSeva patched) | EOL | Clean |
| 4.0.x(LTS, active support ends 21 Oct 2026, security fixes to 21 Oct 2027) | Current | Clean |
| 5.0.x(LTS, released 5 Oct 2026, active support to 5 Oct 2028, security fixes to 5 Oct 2029) | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for Pulsar 2.10.x–4.0.x. Includes ZooKeeper coverage.
- Quarterly CVE patches for Pulsar 2.10.x–4.0.x
- ZooKeeper dependency CVE coverage included
- Docker / Helm delivery
- Signed artifacts (GPG)
- CVE disclosure notifications
- Architecture review
- 24/7 managed operations
OSSeva Assure
Patch plus multi-tenant security audit and compliance documentation.
- Everything in Patch
- Multi-tenant namespace isolation audit
- Authentication (JWT/TLS) configuration review
- SOC 2 / HIPAA attestation package
- ZooKeeper to Oxia metadata store migration planning
- Geo-replication security review
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 monitoring, 15-min SLA, named Pulsar engineers.
- Everything in Assure
- 24/7 broker, bookie, and ZooKeeper monitoring
- 15-minute P1 incident response SLA
- Named senior Pulsar engineer on your account
- Backlog and consumer lag alerting
- Quarterly architecture reviews
- Pulsar Functions and IO connector support
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
helm repo add osseva https://charts.osseva.io
helm repo update
helm install pulsar osseva/pulsar \
--version 3.1.2-1 \
--namespace messaging \
--set broker.replicaCount=3 \
--set bookkeeper.replicaCount=3 \
--set zookeeper.replicaCount=3docker pull artifacts.osseva.io/apache-pulsar:3.1.2-osseva-1
docker run -d \
--name pulsar-standalone \
-p 6650:6650 \
-p 8080:8080 \
artifacts.osseva.io/apache-pulsar:3.1.2-osseva-1 \
bin/pulsar standaloneMigrate from StreamNative Cloud
StreamNative's commercial offering is built around its own Pulsar platform. OSSeva keeps the community Pulsar you already run on your infrastructure — your cloud account, your control plane — with CVE fixes backported to your version and operations support.
Pricing model
OSSeva for Pulsar is priced per cluster — not per topic, per message, or per storage tier. Book a discovery call for a quote.
Frequently asked questions
Does OSSeva patch ZooKeeper alongside Pulsar?
Yes. OSSeva's Pulsar coverage includes ZooKeeper CVE patching. ZooKeeper is the metadata store for Pulsar 2.x and early 3.x, and its CVE stream is monitored and patched as part of the Pulsar engagement.
Do you support Pulsar on the Oxia metadata store (ZooKeeper-free)?
Yes. Pulsar 3.3 and later can run without ZooKeeper on the Oxia metadata store (PIP-335); 3.0, 3.1 and 3.2 need ZooKeeper. OSSeva supports ZooKeeper-mode deployments on every line it patches and Oxia-mode deployments on 4.0.
We use Pulsar Functions and Pulsar IO connectors. Are those in scope?
Yes, for OSSeva Operate customers. Pulsar Functions runtime vulnerabilities and connector-specific CVEs are in scope. For Patch and Assure, coverage focuses on the core broker, bookie, and ZooKeeper layers.
How does OSSeva handle Pulsar's multi-tenant isolation model?
OSSeva Assure includes a multi-tenant namespace isolation audit covering tenant/namespace ACL configuration, authentication provider configuration (JWT, TLS, SASL), and authorization policy review for your tenant topology.
Can you help us migrate from Kafka to Pulsar, or vice versa?
Yes. Migration work, including Kafka to Pulsar and Pulsar to Kafka, runs as a project alongside an OSSeva subscription, with migration playbooks, data migration tooling and senior architect oversight.
Ready to get Apache Pulsar patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.