{ "@id": "urn:uuid:fee85d8a-4e9b-4b3c-8a20-b52486b686ba", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-24T13:19:35.328104+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2021-22160 is a false positive for org.apache.pulsar:pulsar-client-reactive-api 0.5.9-tuxcare.2. CVE-2021-22160 affects Apache Pulsar broker (server-side JWT validation logic), not Pulsar client libraries. This repository is pulsar-client-reactive v0.5.9, a reactive CLIENT library that wraps the standard Pulsar Java client. Exhaustive search found zero JWT validation code, zero authentication provider/service code, and zero server-side components. The CVE describes a vulnerability where the Pulsar broker fails to validate JWT signatures when algorithm is \"none\" - this validation logic exists only in the broker, not in client libraries that merely present JWT tokens for authentication.", "vulnerability": { "name": "CVE-2021-22160" }, "impact_statement": "CVE-2021-22160 affects Apache Pulsar broker (server-side JWT validation logic), not Pulsar client libraries. This repository is pulsar-client-reactive v0.5.9, a reactive CLIENT library that wraps the standard Pulsar Java client. Exhaustive search found zero JWT validation code, zero authentication provider/service code, and zero server-side components. The CVE describes a vulnerability where the Pulsar broker fails to validate JWT signatures when algorithm is \"none\" - this validation logic exists only in the broker, not in client libraries that merely present JWT tokens for authentication." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2022-24280 is a false positive for org.apache.pulsar:pulsar-client-reactive-api 0.5.9-tuxcare.2. false_positive \u2014 CVE-2022-24280 targets the Apache Pulsar server-side Proxy component, which allows attackers to abuse the proxy to make arbitrary TCP/IP connections. The target repository is apache/pulsar-client-reactive v0.5.9, a CLIENT library providing reactive (non-blocking) API wrappers around the Pulsar client for message sending/consuming. This repository contains no proxy code, no proxy dependencies, a...", "vulnerability": { "name": "CVE-2022-24280" }, "impact_statement": "false_positive \u2014 CVE-2022-24280 targets the Apache Pulsar server-side Proxy component, which allows attackers to abuse the proxy to make arbitrary TCP/IP connections. The target repository is apache/pulsar-client-reactive v0.5.9, a CLIENT library providing reactive (non-blocking) API wrappers around the Pulsar client for message sending/consuming. This repository contains no proxy code, no proxy dependencies, a..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2022-33681 affects version 0.5.9-tuxcare.2 of org.apache.pulsar:pulsar-client-reactive-api.", "vulnerability": { "name": "CVE-2022-33681" }, "action_statement": "Vulnerability CVE-2022-33681 affects version 0.5.9-tuxcare.2 of org.apache.pulsar:pulsar-client-reactive-api." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2022-33682 does not affect version 0.5.9-tuxcare.2 of org.apache.pulsar:pulsar-client-reactive-api. not_affected \u2014 CVE-2022-33682 affects the Apache Pulsar Java Client library's TLS hostname verification capability (versions \u22642.10.0, fixed in \u22652.10.2). The pulsar-client-reactive repository is a wrapper library that provides reactive APIs around user-supplied PulsarClient instances. It contains no TLS client implementation code and delegates all TLS/SSL connection handling to the underlying Pulsar Java Clien...", "vulnerability": { "name": "CVE-2022-33682" }, "impact_statement": "not_affected \u2014 CVE-2022-33682 affects the Apache Pulsar Java Client library's TLS hostname verification capability (versions \u22642.10.0, fixed in \u22652.10.2). The pulsar-client-reactive repository is a wrapper library that provides reactive APIs around user-supplied PulsarClient instances. It contains no TLS client implementation code and delegates all TLS/SSL connection handling to the underlying Pulsar Java Clien..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2022-33683 is a false positive for org.apache.pulsar:pulsar-client-reactive-api 0.5.9-tuxcare.2. false_positive \u2014 CVE-2022-33683 is a false positive for pulsar-client-reactive. The CVE explicitly affects \"Apache Pulsar Brokers and Proxies\" that create internal Pulsar Admin Clients without TLS certificate verification. The target repository (pulsar-client-reactive v0.5.9) is a reactive CLIENT library that wraps the standard Pulsar client - it contains no broker, proxy, or admin client code. Exhaustive searc...", "vulnerability": { "name": "CVE-2022-33683" }, "impact_statement": "false_positive \u2014 CVE-2022-33683 is a false positive for pulsar-client-reactive. The CVE explicitly affects \"Apache Pulsar Brokers and Proxies\" that create internal Pulsar Admin Clients without TLS certificate verification. The target repository (pulsar-client-reactive v0.5.9) is a reactive CLIENT library that wraps the standard Pulsar client - it contains no broker, proxy, or admin client code. Exhaustive searc..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2022-33684 is a false positive for org.apache.pulsar:pulsar-client-reactive-api 0.5.9-tuxcare.2. CVE-2022-33684 concerns the Apache Pulsar C++ Client and Python Client (which wraps C++) failing to verify peer TLS certificates during OAuth2.0 Client Credential Flow. The target repository is pulsar-client-reactive, a Java-based reactive wrapper library that contains no C++ or Python code, no OAuth2.0 implementation, and no TLS verification logic. The CVE explicitly states it affects only C++ and Python clients, with no mention of Java clients. This is a wrong-project match: the CVE's affected component (C++ client OAuth2.0 TLS implementation) is absent from the entire Java-based repository.", "vulnerability": { "name": "CVE-2022-33684" }, "impact_statement": "CVE-2022-33684 concerns the Apache Pulsar C++ Client and Python Client (which wraps C++) failing to verify peer TLS certificates during OAuth2.0 Client Credential Flow. The target repository is pulsar-client-reactive, a Java-based reactive wrapper library that contains no C++ or Python code, no OAuth2.0 implementation, and no TLS verification logic. The CVE explicitly states it affects only C++ and Python clients, with no mention of Java clients. This is a wrong-project match: the CVE's affected component (C++ client OAuth2.0 TLS implementation) is absent from the entire Java-based repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2023-30429 is a false positive for org.apache.pulsar:pulsar-client-reactive-api 0.5.9-tuxcare.2. CVE-2023-30429 is a wrong-project match. The advisory concerns Apache Pulsar Function Worker (a server-side component that executes Pulsar Functions), but this repository is pulsar-client-reactive (a client library for producing/consuming Pulsar messages using reactive streams). The affected component's code is completely absent from this repository\u2014there is no Function Worker code, no vendored copy, and no dependency relationship. The vulnerability involves authorization logic in the Function Worker's handling of proxy-forwarded mTLS requests, which is not implemented in this client library.", "vulnerability": { "name": "CVE-2023-30429" }, "impact_statement": "CVE-2023-30429 is a wrong-project match. The advisory concerns Apache Pulsar Function Worker (a server-side component that executes Pulsar Functions), but this repository is pulsar-client-reactive (a client library for producing/consuming Pulsar messages using reactive streams). The affected component's code is completely absent from this repository\u2014there is no Function Worker code, no vendored copy, and no dependency relationship. The vulnerability involves authorization logic in the Function Worker's handling of proxy-forwarded mTLS requests, which is not implemented in this client library." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2023-31007 is a false positive for org.apache.pulsar:pulsar-client-reactive-api 0.5.9-tuxcare.2. false_positive \u2014 CVE-2023-31007 is a wrong-project match. The advisory concerns Apache Pulsar Broker (server-side authentication handling), but this repository is pulsar-client-reactive version 0.5.9, a Reactive Streams client library for Apache Pulsar. The vulnerable component (broker authentication session management with authenticateOriginalAuthData configuration) is not present in this client library. Exhau...", "vulnerability": { "name": "CVE-2023-31007" }, "impact_statement": "false_positive \u2014 CVE-2023-31007 is a wrong-project match. The advisory concerns Apache Pulsar Broker (server-side authentication handling), but this repository is pulsar-client-reactive version 0.5.9, a Reactive Streams client library for Apache Pulsar. The vulnerable component (broker authentication session management with authenticateOriginalAuthData configuration) is not present in this client library. Exhau..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2023-37544 is a false positive for org.apache.pulsar:pulsar-client-reactive-api 0.5.9-tuxcare.2. CVE-2023-37544 is a false positive for pulsar-client-reactive version 0.5.9. The vulnerability affects Apache Pulsar WebSocket Proxy (a server-side component), but the target repository is pulsar-client-reactive, which is a client library for connecting TO Pulsar brokers. The vulnerable WebSocket Proxy code is completely absent from this repository - no /pingpong endpoint, no WebSocket Proxy classes, no server-side code exists. The repository contains only client-side APIs (ReactiveMessageConsumer, ReactiveMessageSender, etc.). Dependencies are client-only libraries (pulsar-client-api, pulsar-client-shaded), not the proxy/broker components. This is a wrong-project match: the CVE concerns a different Apache Pulsar component than what this repository implements.", "vulnerability": { "name": "CVE-2023-37544" }, "impact_statement": "CVE-2023-37544 is a false positive for pulsar-client-reactive version 0.5.9. The vulnerability affects Apache Pulsar WebSocket Proxy (a server-side component), but the target repository is pulsar-client-reactive, which is a client library for connecting TO Pulsar brokers. The vulnerable WebSocket Proxy code is completely absent from this repository - no /pingpong endpoint, no WebSocket Proxy classes, no server-side code exists. The repository contains only client-side APIs (ReactiveMessageConsumer, ReactiveMessageSender, etc.). Dependencies are client-only libraries (pulsar-client-api, pulsar-client-shaded), not the proxy/broker components. This is a wrong-project match: the CVE concerns a different Apache Pulsar component than what this repository implements." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2023-37579 is a false positive for org.apache.pulsar:pulsar-client-reactive-api 0.5.9-tuxcare.2. CVE-2023-37579 is a false positive for this repository. The CVE affects the Apache Pulsar Function Worker server component, specifically its REST API endpoints for retrieving source and sink configurations. This repository (pulsar-client-reactive v0.5.9) is a reactive client library for Apache Pulsar, not the Function Worker server. The Function Worker code is not present in this repository - neither as the project itself, nor as a vendored copy, nor as a dependency. This client library only depends on org.apache.pulsar:pulsar-client (the message client), not the Function Worker server artifacts. The vulnerable REST endpoints (/admin/v3/sources, /admin/v3/sinks) and authorization logic affected by this CVE do not exist in this codebase.", "vulnerability": { "name": "CVE-2023-37579" }, "impact_statement": "CVE-2023-37579 is a false positive for this repository. The CVE affects the Apache Pulsar Function Worker server component, specifically its REST API endpoints for retrieving source and sink configurations. This repository (pulsar-client-reactive v0.5.9) is a reactive client library for Apache Pulsar, not the Function Worker server. The Function Worker code is not present in this repository - neither as the project itself, nor as a vendored copy, nor as a dependency. This client library only depends on org.apache.pulsar:pulsar-client (the message client), not the Function Worker server artifacts. The vulnerable REST endpoints (/admin/v3/sources, /admin/v3/sinks) and authorization logic affected by this CVE do not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-api@0.5.9-tuxcare.2" } } ], "timestamp": "2026-10-24T13:19:35.328104+00:00", "status_notes": "Vulnerability CVE-2023-51437 is a false positive for org.apache.pulsar:pulsar-client-reactive-api 0.5.9-tuxcare.2. CVE-2023-51437 is a false positive for pulsar-client-reactive. The vulnerability affects Apache Pulsar's server-side SASL Authentication Provider (found in pulsar-broker, proxy, websocket-proxy, and function-worker components). This repository is purely a client library (pulsar-client-reactive) that provides a reactive streams adapter for the Pulsar Java client. The vulnerable component is not present in this repository: no SASL authentication code exists, no server components are vendored, and dependencies are limited to client libraries (pulsar-client, pulsar-client-api) only.", "vulnerability": { "name": "CVE-2023-51437" }, "impact_statement": "CVE-2023-51437 is a false positive for pulsar-client-reactive. The vulnerability affects Apache Pulsar's server-side SASL Authentication Provider (found in pulsar-broker, proxy, websocket-proxy, and function-worker components). This repository is purely a client library (pulsar-client-reactive) that provides a reactive streams adapter for the Pulsar Java client. The vulnerable component is not present in this repository: no SASL authentication code exists, no server components are vendored, and dependencies are limited to client libraries (pulsar-client, pulsar-client-api) only." } ] }