Search before reporting
MotivationHi Team, Since we are using jetty 12.1.12 in pulsar 4.0, Can we get rid of jetty-bom from below modules? <jetty9.version>9.4.58.v20250814</jetty9.version> The transitive dependencies are showcasing security vulnerabilities - CVE-2026-10050, CVE-2026-2332 org.eclipse.jetty:jetty-client:9.4.58.v20250814 Please check and suggest on the impact SolutionNo response AlternativesNo response Anything else?No response Are you willing to submit a PR?
|
Replies: 1 comment 1 reply
@adarshhm6 I'm not aware of any current way since tiered-storage/file-system and pulsar-io/alluxio require Jetty 9.4.x What problem do you have with the Jetty 9 dependencies? If you are concerned about the CVEs, you have the option to not use the components that ship a vulnerable Jetty 9 dependency. The core Pulsar distribution doesn't ship with Jetty 9. |
|
@lhotari Thanks for the response. Yes the concern was majorly with respect to CVE to understand whether the transitive dependencies have adverse impact. |
@adarshhm6 I'm not aware of any current way since tiered-storage/file-system and pulsar-io/alluxio require Jetty 9.4.x
The only way to get security fixes for Jetty 9.4.x is to get commercial support and commercial releases, https://www.herodevs.com/support/nes-for-jetty. This isn't an option for Apache Pulsar OSS.
What problem do you have with the Jetty 9 dependencies? If you are concerned about the CVEs, you have the option to not use the components that ship a vulnerable Jetty 9 dependency. The core Pulsar distribution doesn't ship with Jetty 9.
It's very rare that anyone would be using
tie…