apache-pulsar.advisories.yaml

schema-version: 2.0.2

package:
  name: apache-pulsar

advisories:
  - id: CGA-3mr5-vjhc-vp3x
    aliases:
      - CVE-2024-53990
      - GHSA-mfj5-cf8g-g2fv
    events:
      - timestamp: 2024-12-17T21:08:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: d9d962ed5f911dfc
            componentName: async-http-client
            componentVersion: 2.12.1
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/org.asynchttpclient-async-http-client-2.12.1.jar
            scanner: grype
      - timestamp: 2024-12-18T00:08:34Z
        type: fixed
        data:
          fixed-version: 4.0.1-r1

  - id: CGA-4p2w-98gj-q85p
    aliases:
      - CVE-2025-68161
      - GHSA-vc5p-v9hr-52mj
    events:
      - timestamp: 2025-12-20T11:06:40Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 7f3b8a9e1af7742a
            componentName: log4j-core
            componentVersion: 2.23.1
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/instances/java-instance.jar
            scanner: grype
      - timestamp: 2026-01-02T09:30:04Z
        type: pending-upstream-fix
        data:
          note: Bumping to fix version of log4j-core causes build failures due to missing classes. Upstream maintainers must implement compatibility to remediate.

  - id: CGA-9gfp-hc4v-798r
    aliases:
      - CVE-2025-67735
      - GHSA-84h7-rjj3-6jx4
    events:
      - timestamp: 2025-12-17T11:22:33Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 2f34c38888a0485e
            componentName: netty-codec-http
            componentVersion: 4.1.128.Final
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/io.netty-netty-codec-http-4.1.128.Final.jar
            scanner: grype
      - timestamp: 2025-12-19T11:24:41Z
        type: fixed
        data:
          fixed-version: 4.1.2-r1

  - id: CGA-9hqf-2qh7-jqxh
    aliases:
      - CVE-2025-11965
      - GHSA-h5fg-jpgr-rv9c
    events:
      - timestamp: 2025-10-24T07:18:03Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 8df29d18fcd3b821
            componentName: vertx-web
            componentVersion: 4.5.10
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/io.vertx-vertx-web-4.5.10.jar
            scanner: grype
      - timestamp: 2025-10-24T08:48:50Z
        type: fixed
        data:
          fixed-version: 4.1.1-r2

  - id: CGA-cw8v-qwxh-pc5f
    aliases:
      - CVE-2025-55163
      - GHSA-prj3-ccx8-p6x4
    events:
      - timestamp: 2025-08-14T11:42:43Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 07b1df54b60031ff
            componentName: netty-codec-http2
            componentVersion: 4.1.122.Final
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/io.netty-netty-codec-http2-4.1.122.Final.jar
            scanner: grype
      - timestamp: 2025-08-15T15:14:58Z
        type: fixed
        data:
          fixed-version: 4.0.6-r1

  - id: CGA-fwwv-f55r-xf36
    aliases:
      - CVE-2025-48924
      - GHSA-j288-q9x7-2f5v
    events:
      - timestamp: 2025-07-12T07:32:23Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 5e0b3101a42cbe7e
            componentName: commons-lang
            componentVersion: "2.6"
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/commons-lang-commons-lang-2.6.jar
            scanner: grype
      - timestamp: 2025-07-17T00:14:54Z
        type: pending-upstream-fix
        data:
          note: upstream needs to remove commons-lang 2.6 to address CVE-2025-48924

  - id: CGA-g9f5-gvgx-jg3v
    aliases:
      - CVE-2025-24970
      - GHSA-4g8c-wm8x-jfhw
    events:
      - timestamp: 2025-02-11T08:09:48Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 55bb0b158cf44b87
            componentName: netty-handler
            componentVersion: 4.1.116.Final
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/io.netty-netty-handler-4.1.116.Final.jar
            scanner: grype
      - timestamp: 2025-02-27T13:37:25Z
        type: fixed
        data:
          fixed-version: 4.0.3-r0

  - id: CGA-h3f6-xv72-mrqm
    aliases:
      - CVE-2025-46392
      - GHSA-pvp8-3xj6-8c6x
    events:
      - timestamp: 2025-05-10T08:18:03Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 17e0a39023fabc45
            componentName: commons-configuration
            componentVersion: "1.10"
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/commons-configuration-commons-configuration-1.10.jar
            scanner: grype
      - timestamp: 2025-07-17T00:19:15Z
        type: pending-upstream-fix
        data:
          note: upstream needs to either upgrade commons-configuration to 2.x version or remove 1.x version to fix CVE.

  - id: CGA-m384-9gc6-jc6v
    aliases:
      - CVE-2024-29371
      - GHSA-3677-xxcr-wjqv
    events:
      - timestamp: 2025-12-19T11:36:55Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: b98e55607bfef438
            componentName: jose4j
            componentVersion: 0.9.4
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/org.bitbucket.b_c-jose4j-0.9.4.jar
            scanner: grype
      - timestamp: 2025-12-20T11:05:34Z
        type: fixed
        data:
          fixed-version: 4.1.2-r2
      - timestamp: 2026-01-07T11:09:08Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 71e0b1ec8116f4f7
            componentName: jose4j
            componentVersion: 0.9.5
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/org.bitbucket.b_c-jose4j-0.9.5.jar
            scanner: grype

  - id: CGA-mxg5-5rwg-w4hr
    aliases:
      - CVE-2025-25193
      - GHSA-389x-839f-4rhx
    events:
      - timestamp: 2025-02-11T08:09:46Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 751d34364b77c301
            componentName: netty-common
            componentVersion: 4.1.116.Final
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/io.netty-netty-common-4.1.116.Final.jar
            scanner: grype
      - timestamp: 2025-02-13T19:41:38Z
        type: false-positive-determination
        data:
          type: vulnerable-code-cannot-be-controlled-by-adversary
          note: Vulnerability affects only Windows systems.

  - id: CGA-r2rw-m548-3w3h
    aliases:
      - CVE-2025-58057
      - GHSA-3p8m-j85q-pgmj
    events:
      - timestamp: 2025-09-04T07:05:36Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: fc5e05269c86aa7c
            componentName: netty-codec
            componentVersion: 4.1.124.Final
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/io.netty-netty-codec-4.1.124.Final.jar
            scanner: grype
      - timestamp: 2025-09-10T08:04:45Z
        type: fixed
        data:
          fixed-version: 4.0.6-r2

  - id: CGA-rhmq-h236-x4hm
    aliases:
      - CVE-2025-12383
      - GHSA-7p63-w6x9-6gr7
    events:
      - timestamp: 2025-11-19T18:00:57Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 25ce2514adb64cf2
            componentName: jersey-client
            componentVersion: "2.42"
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/org.glassfish.jersey.core-jersey-client-2.42.jar
            scanner: grype
      - timestamp: 2025-11-20T17:14:50Z
        type: fixed
        data:
          fixed-version: 4.1.2-r0

  - id: CGA-vqpg-qrw9-gjxv
    aliases:
      - CVE-2025-58056
      - GHSA-fghv-69vj-qj49
    events:
      - timestamp: 2025-09-06T07:08:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: b6291634b8dd020c
            componentName: netty-codec-http
            componentVersion: 4.1.124.Final
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/io.netty-netty-codec-http-4.1.124.Final.jar
            scanner: grype
      - timestamp: 2025-09-10T08:04:46Z
        type: fixed
        data:
          fixed-version: 4.0.6-r2

  - id: CGA-w8m5-m487-94w6
    aliases:
      - CVE-2024-6763
      - GHSA-qh8g-58pp-2wxh
    events:
      - timestamp: 2024-12-17T21:08:27Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 71c4c3b48deaff20
            componentName: jetty-http
            componentVersion: 9.4.56.v20240826
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/org.eclipse.jetty-jetty-http-9.4.56.v20240826.jar
            scanner: grype
      - timestamp: 2024-12-18T14:41:16Z
        type: pending-upstream-fix
        data:
          note: The fix version of jetty-http is >=12.0.12, requiring a large refactor; there is an issue tracking the effort https://github.com/apache/pulsar/issues/22939
      - timestamp: 2025-01-13T21:22:02Z
        type: pending-upstream-fix
        data:
          note: Attempting to patch this CVE leads to build failures, and will require an update from upstream maintainers to remediate.
      - timestamp: 2025-03-19T08:27:21Z
        type: fixed
        data:
          fixed-version: 4.0.3-r0
      - timestamp: 2025-03-21T07:08:36Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 71c4c3b48deaff20
            componentName: jetty-http
            componentVersion: 9.4.56.v20240826
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/org.eclipse.jetty-jetty-http-9.4.56.v20240826.jar
            scanner: grype
      - timestamp: 2025-03-21T08:07:35Z
        type: fixed
        data:
          fixed-version: 4.0.3-r0
      - timestamp: 2025-03-24T10:44:10Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 71c4c3b48deaff20
            componentName: jetty-http
            componentVersion: 9.4.56.v20240826
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/org.eclipse.jetty-jetty-http-9.4.56.v20240826.jar
            scanner: grype
      - timestamp: 2025-05-14T23:42:31Z
        type: pending-upstream-fix
        data:
          note: jetty project has backported patch to versions 9, 10 and 11 with a fix for CVE-2024-6763 but has not yet generated releases. Apache-pulsar upstream will have to pull in the updates once they become available

  - id: CGA-w9rg-f495-r49m
    aliases:
      - CVE-2025-58457
      - GHSA-2hmj-97jw-28jh
    events:
      - timestamp: 2025-09-25T07:06:23Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: b52f7e94199c42f6
            componentName: zookeeper
            componentVersion: 3.9.3
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/org.apache.zookeeper-zookeeper-3.9.3.jar
            scanner: grype
      - timestamp: 2025-09-26T07:04:38Z
        type: fixed
        data:
          fixed-version: 4.1.0-r1

  - id: CGA-x8hh-m38w-8m8j
    aliases:
      - CVE-2025-11966
      - GHSA-45p5-v273-3qqr
    events:
      - timestamp: 2025-10-24T07:18:02Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-pulsar
            componentID: 8df29d18fcd3b821
            componentName: vertx-web
            componentVersion: 4.5.10
            componentType: java-archive
            componentLocation: /usr/share/java/pulsar/lib/io.vertx-vertx-web-4.5.10.jar
            scanner: grype
      - timestamp: 2025-10-24T08:48:51Z
        type: fixed
        data:
          fixed-version: 4.1.1-r2