CVE-2024-27135

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true".

This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0.

2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-913

Affected software

No affected versions have been published.

Timeline

Published: Mar 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-271366.1XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensit CVE-2024-271375.3In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate CVE-2024-271387.5** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user regis CVE-2024-271397.5** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauth CVE-2024-27146.5A vulnerability has been found in Campcodes Complete Online DJ Booking System 1.0 and classified as critical. Affected by this vulnerability CVE-2024-271405.4** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apach CVE-2024-271415.9Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is CVE-2024-271425.9Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is CVE-2024-271439.8Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote CVE-2024-271449.8The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any inse CVE-2024-271459.8The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba pri CVE-2024-271466.7The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL.