OSSEVA FOR APACHE PULSAR

Apache Pulsar support: patched, protected, operated.

OSSeva provides Apache Pulsar support for 2.10.x through 5.0.x, including patched builds for 2.10.x, 2.11.x and 3.0.x to 3.2.x after the community stops fixing them. Apache Pulsar is the multi-tenant, cloud-native messaging and streaming platform powering financial services and enterprise data pipelines globally. Support covers CVE-patched builds, hardened configurations, and 24/7 managed operations for 2.10.x and 3.x.

Reply within 1 business day · No commitment · or book a 15-minute call

Which vendors provide patched Apache Pulsar after end of life? Pulsar Extended Support: Patched 2.10 to 3.2 Builds.

Last reviewed 29 September 2026

Trusted globally by enterprises

Why now

Commercial Pulsar support centres on vendor platforms

StreamNative, the main commercial Pulsar vendor, builds its offering around its own Pulsar platform and publishes no version-support policy for community Pulsar. DataStax Luna Streaming is now IBM Elite Support for Apache Pulsar, built on IBM's own 3.1 distribution. Teams running community Pulsar on their own clusters have few options for patches on the version they already run.

Pulsar's rapid release cadence creates EOL exposure

Apache Pulsar releases major versions frequently, with community support windows shorter than most enterprise upgrade cycles. Pulsar 2.10.x and 2.11.x are already past active community support, but remain in production at hundreds of enterprises.

ZooKeeper dependency creates compounded CVE risk

Older Pulsar versions depend heavily on ZooKeeper for metadata. ZooKeeper has its own CVE stream — OSSeva monitors and patches both Pulsar and its ZooKeeper dependency, closing a gap that community support leaves open.

Versions covered

All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.

Version	JVM	Status	Patches	Active CVEs
2.10.x(Full CVE coverage)	Java 8–17	Extended	Active	Clean
2.11.x(Full CVE coverage)	Java 8–17	Extended	Active	Clean
3.0.x(LTS, security support ended 2 May 2026 — OSSeva patched)	Java 17	EOL	Active	Clean
3.1.x(Community EOL — OSSeva patched)	Java 17	EOL	Active	Clean
3.2.x(Community EOL — OSSeva patched)	Java 17	EOL	Active	Clean
4.0.x(LTS, active support ends 21 Oct 2026, security fixes to 21 Oct 2027)	Java 21	Current	Active	Clean
5.0.x(LTS, released 5 Oct 2026, active support to 5 Oct 2028, security fixes to 5 Oct 2029)	Java 21	Current	Active	Clean

Apache Pulsar end of life dates for every version →

Running a Apache Pulsar version or build not listed here?

What you get

Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.

OSSeva Patch

CVE patches for Pulsar 2.10.x–5.0.x. Includes ZooKeeper coverage.

Quarterly CVE patches for Pulsar 2.10.x–5.0.x
ZooKeeper dependency CVE coverage included
Docker / Helm delivery
Signed artifacts (GPG)
CVE disclosure notifications
Architecture review
24/7 managed operations

OSSeva Assure

Patch plus multi-tenant security audit and compliance documentation.

Everything in Patch
Multi-tenant namespace isolation audit
Authentication (JWT/TLS) configuration review
SOC 2 / HIPAA attestation package
ZooKeeper to Oxia metadata store migration planning
Geo-replication security review
24/7 reactive support

OSSeva Operate

Full MSP: 24/7 monitoring, 15-min SLA, named Pulsar engineers.

Everything in Assure
24/7 broker, bookie, and ZooKeeper monitoring
15-minute P1 incident response SLA
Named senior Pulsar engineer on your account
Backlog and consumer lag alerting
Quarterly architecture reviews
Pulsar Functions and IO connector support

All tiers priced per cluster/application — not per core.

How it installs

OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.

Helm — OSSeva Pulsar clusterbash

helm repo add osseva https://charts.osseva.io
helm repo update

helm install pulsar osseva/pulsar \
  --version 3.1.2-1 \
  --namespace messaging \
  --set broker.replicaCount=3 \
  --set bookkeeper.replicaCount=3 \
  --set zookeeper.replicaCount=3

Docker — OSSeva Pulsar standalonebash

docker pull artifacts.osseva.io/apache-pulsar:3.1.2-osseva-1

docker run -d \
  --name pulsar-standalone \
  -p 6650:6650 \
  -p 8080:8080 \
  artifacts.osseva.io/apache-pulsar:3.1.2-osseva-1 \
  bin/pulsar standalone

Migrate from StreamNative Cloud

StreamNative's commercial offering is built around its own Pulsar platform. OSSeva keeps the community Pulsar you already run on your infrastructure — your cloud account, your control plane — with CVE fixes backported to your version and operations support.

↗

Pricing model

OSSeva for Pulsar is priced per cluster — not per topic, per message, or per storage tier. Book a discovery call for a quote.

Compliance library

📄SOC 2 compliance evidence package

Request →

📄Sample Audit Narrative

Request →

📄Pen-Test Report Summary

Request →

📄HIPAA Technical Safeguard Matrix

Request →

Questions

Frequently asked questions

Book a 15-minute call

Does OSSeva patch ZooKeeper alongside Pulsar?

Yes. OSSeva's Pulsar coverage includes ZooKeeper CVE patching. ZooKeeper is the metadata store for Pulsar 2.x and early 3.x, and its CVE stream is monitored and patched as part of the Pulsar engagement.

Do you support Pulsar on the Oxia metadata store (ZooKeeper-free)?

Yes. Pulsar 3.3 and later can run without ZooKeeper on the Oxia metadata store (PIP-335); 3.0, 3.1 and 3.2 need ZooKeeper. OSSeva supports ZooKeeper-mode deployments on every line it patches and Oxia-mode deployments on 4.0.

We use Pulsar Functions and Pulsar IO connectors. Are those in scope?

Yes, for OSSeva Operate customers. Pulsar Functions runtime vulnerabilities and connector-specific CVEs are in scope. For Patch and Assure, coverage focuses on the core broker, bookie, and ZooKeeper layers.

How does OSSeva handle Pulsar's multi-tenant isolation model?

OSSeva Assure includes a multi-tenant namespace isolation audit covering tenant/namespace ACL configuration, authentication provider configuration (JWT, TLS, SASL), and authorization policy review for your tenant topology.

Can you help us migrate from Kafka to Pulsar, or vice versa?

Yes. Migration work, including Kafka to Pulsar and Pulsar to Kafka, runs as a project alongside an OSSeva subscription, with migration playbooks, data migration tooling and senior architect oversight.

Who provides Apache Pulsar support besides the Apache Pulsar project?

Support comes from the Apache Pulsar community, from commercial vendors such as StreamNative and IBM, whose Elite Support for Apache Pulsar is built on IBM's own 3.1 distribution, and from cloud managed services. OSSeva fits where you run community Pulsar on your own clusters. It offers one contract across the rest of your stack, includes end-of-life versions, and runs where you run.

Does OSSeva support current Apache Pulsar versions or only end-of-life ones?

Both. Pulsar 4.0.x and 5.0.x, the current LTS lines, are covered alongside 2.10.x and 2.11.x on extended support and 3.0.x to 3.2.x, which OSSeva keeps patched after community end of life. OSSeva Operate patches Critical CVEs (CVSS ≥ 9.0) within 48 hours and High within 7 days.

How is OSSeva Apache Pulsar support priced?

OSSeva for Pulsar is priced per cluster, not per topic, per message or per storage tier. Patch covers the patched builds, Assure adds the audit work and 24/7 reactive support, and Operate adds proactive 24/7 monitoring with a 15-minute P1 SLA. Book a discovery call for a quote.

Get a quote

Ready to get Apache Pulsar patched and supported?

Tell us your Apache Pulsar versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.

Prefer to talk or read more first?

Book a 15-minute call See all tiers and pricing