CVE-2023-37544 json
Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS
published 2023-12-20 2 y ago modified 2026-06-17 4 mo ago also GHSA-83q5-whqp-r8jr , EUVD-2023-3156
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.
This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.
The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.
2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5. 2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2. 3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1. 3.1 Pulsar WebSocket Proxy users are unaffected. Any users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.
Patch / fix
- maven org.apache.pulsar:pulsar-websocket 2.10.5, 2.11.2, 3.0.1
- apache pulsar 2.10.5, 2.11.2
Exploit prediction
1.35% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.pulsar:pulsar-websocket | <2.10.5 >=2.11.0, <2.11.2 >=3.0.0, <3.0.1 |
2.10.5 2.11.2 3.0.1 |
Affected products
- Apache Software Foundation Apache Pulsar WebSocket Proxy
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/apache/pulsar/commit/11ee36d0351644a006d2a8639bdcc714fb602358
web
-
github.com
/apache/pulsar/commit/894192fb6542e504be43034a3c33e90f9c6e528a
web
-
github.com
/apache/pulsar/commit/eac263e8f2a93d3b9f707b97c7bbcbc2a826569f
web
-
lists.apache.org
/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2023/12/20/2
web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2023-37544
advisory
-
github.com
/apache/pulsar
package
Sources
- CVE List CVE-2023-37544
- GitHub Advisory GHSA-83q5-whqp-r8jr
- NVD CVE-2023-37544
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.