Read the docs
TI-2023-19142 Aliases CVE-2023-37544GHSA-83q5-whqp-r8jr

Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS

Priority LOW 36CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0. The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature. 2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5. 2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2. 3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1. 3.1 Pulsar WebSocket Proxy users are unaffected. Any users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.

Why it matters now

EPSS 0.01351 71st percentileScored 2026-11-07
Fix Fixed org.apache.pulsar:pulsar-websocket (Maven): 2.10.5, 2.11.2, 3.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Pulsar WebSocket Proxy2.8.0 and later; 2.9.0 and later; 2.10.0 – 2.10.4; 2.11.0 – 2.11.1; 3.0.0—No fix listedCNA
—org.apache.pulsar:pulsar-websocket (Maven)before 2.10.52.10.5Patch availableGHSA-83q5-whqp-r8jr
—org.apache.pulsar:pulsar-websocket (Maven)2.11.0 to before 2.11.22.11.2Patch availableGHSA-83q5-whqp-r8jr
—org.apache.pulsar:pulsar-websocket (Maven)3.0.0 to before 3.0.13.0.1Patch availableGHSA-83q5-whqp-r8jr
  • Apache Pulsar WebSocket Proxy VendorApache Affected 2.8.0 and later; 2.9.0 and later; 2.10.0 – 2.10.4; 2.11.0 – 2.11.1; 3.0.0 Fixed in — No fix listed CNA
  • org.apache.pulsar:pulsar-websocket (Maven) Vendor— Affected before 2.10.5 Fixed in 2.10.5 Patch available GHSA-83q5-whqp-r8jr
  • org.apache.pulsar:pulsar-websocket (Maven) Vendor— Affected 2.11.0 to before 2.11.2 Fixed in 2.11.2 Patch available GHSA-83q5-whqp-r8jr
  • org.apache.pulsar:pulsar-websocket (Maven) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-83q5-whqp-r8jr

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*before 2.10.5; 2.11.0 to before 2.11.2VulnerableApache
cpe:2.3:a:apache:pulsar:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableApache
  • cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions before 2.10.5; 2.11.0 to before 2.11.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:pulsar:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-83q5-whqp-r8jr org.apache.pulsar:pulsar-websocket (Maven) Fixed in 2.10.5 Advisory →
  • Fix · GHSA-83q5-whqp-r8jr org.apache.pulsar:pulsar-websocket (Maven) Fixed in 2.11.2 Advisory →
  • Fix · GHSA-83q5-whqp-r8jr org.apache.pulsar:pulsar-websocket (Maven) Fixed in 3.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37544
  2. 2026-10-03 Alias added: GHSA-83q5-whqp-r8jr

References

Advisory 2

Other 5

  • TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
  • TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
  • TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
  • TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
  • TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
  • TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences