Cyber ·
Apache Pulsar fixes 14 CVEs in versions 4.0.14, 4.2.5 and 5.0.0
The Apache Pulsar PMC published 14 security advisories on October 21, 2026, fixed in versions 4.0.14, 4.2.5 and 5.0.0. The official recommendation is to upgrade.
On October 21, 2026, the Apache Pulsar PMC published 14 security advisories (CVEs) for Apache Pulsar. According to the announcement, the breakdown is 1 critical, 4 high, 4 medium and 5 low severity issues. All were fixed in versions 4.0.14, 4.2.5 and 5.0.0, and users are advised to upgrade to one of them. The post was written by Lari Hotari on the oss-sec list and is an automatic translation of the original content, so check the English source and the official Apache project threads for details on each CVE, including affected components, vectors and mitigations. To verify, confirm the version in use through your installation's command or dashboard and compare it with the fixed versions listed. Organizations running Pulsar as a messaging backbone should prioritize the upgrade and record the result in their asset inventory. Rota Nacional does not patch Pulsar or take part in the fix; it is third-party infrastructure. If you use AI to study the advisory, do not paste configurations containing server names, credentials, tokens or personal data. Rota detects and applies the organization's policy before any model runs, but removing such data yourself remains best practice.