Read the docs
TI-2024-17990 Aliases CVE-2024-27135GHSA-xp2r-g8qq-44hh

Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution

Priority MEDIUM 52CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05983 93rd percentileScored 2026-11-07
Fix Partial Apache Pulsar (Apache Software Foundation): 2.10.6, 2.11.4, 3.0.3 +2org.apache.pulsar:pulsar-functions-worker (Maven): 2.10.6, 2.11.4, 3.0.3 +2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Pulsar2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3; 3.2.0 to before 3.2.12.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1Patch availableCNA
—org.apache.pulsar:pulsar-functions-worker (Maven)2.4.0 to before 2.10.62.10.6Patch availableGHSA-xp2r-g8qq-44hh
—org.apache.pulsar:pulsar-functions-worker (Maven)2.11.0 to before 2.11.42.11.4Patch availableGHSA-xp2r-g8qq-44hh
—org.apache.pulsar:pulsar-functions-worker (Maven)3.0.0 to before 3.0.33.0.3Patch availableGHSA-xp2r-g8qq-44hh
—org.apache.pulsar:pulsar-functions-worker (Maven)3.1.0 to before 3.1.33.1.3Patch availableGHSA-xp2r-g8qq-44hh
—org.apache.pulsar:pulsar-functions-worker (Maven)3.2.0 to before 3.2.13.2.1Patch availableGHSA-xp2r-g8qq-44hh
  • Apache Pulsar VendorApache Affected 2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3; 3.2.0 to before 3.2.1 Fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1 Patch available CNA
  • org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 2.4.0 to before 2.10.6 Fixed in 2.10.6 Patch available GHSA-xp2r-g8qq-44hh
  • org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 2.11.0 to before 2.11.4 Fixed in 2.11.4 Patch available GHSA-xp2r-g8qq-44hh
  • org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 3.0.0 to before 3.0.3 Fixed in 3.0.3 Patch available GHSA-xp2r-g8qq-44hh
  • org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 3.1.0 to before 3.1.3 Fixed in 3.1.3 Patch available GHSA-xp2r-g8qq-44hh
  • org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 3.2.0 to before 3.2.1 Fixed in 3.2.1 Patch available GHSA-xp2r-g8qq-44hh

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3VulnerableApache
cpe:2.3:a:apache:pulsar:3.2.0:-:*:*:*:*:*:*3.2.0VulnerableApache
  • cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions 2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:pulsar:3.2.0:-:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Pulsar (Apache Software Foundation) Fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1
  • Fix · GHSA-xp2r-g8qq-44hh org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 2.10.6 Advisory →
  • Fix · GHSA-xp2r-g8qq-44hh org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 2.11.4 Advisory →
  • Fix · GHSA-xp2r-g8qq-44hh org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 3.0.3 Advisory →
  • Fix · GHSA-xp2r-g8qq-44hh org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 3.1.3 Advisory →
  • Fix · GHSA-xp2r-g8qq-44hh org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 3.2.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Pulsar 2.10.6, 2.11.4 and 3 more versions

    4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File ModificationPriority HIGH 76
    • TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS ProxyingPriority MEDIUM 42
    • TI-2024-18679 Apache Pulsar: Improper Authorization For Topic-Level Policy ManagementPriority LOW 32
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Not affected: 4 products
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-27135
  2. 2026-10-03 Alias added: GHSA-xp2r-g8qq-44hh

References

Advisory 4

Other 2

  • TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
  • TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
  • TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
  • TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
  • TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8
  • TI-2023-19177 Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials CVSS 3.1HIGH 8.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences