Security CVEs with eclipse jetty9-version

[adarshhm6]

Search before reporting

• I searched in the issues and found nothing similar.

Motivation

Hi Team,

Since we are using jetty 12.1.12 in pulsar 4.0, Can we get rid of jetty-bom from below modules?

<jetty9.version>9.4.58.v20250814</jetty9.version>

The transitive dependencies are showcasing security vulnerabilities - CVE-2026-10050, CVE-2026-2332

org.eclipse.jetty:jetty-client:9.4.58.v20250814
org.eclipse.jetty:jetty-continuation:9.4.58.v20250814
org.eclipse.jetty:jetty-http:9.4.58.v20250814
org.eclipse.jetty:jetty-io:9.4.58.v20250814
org.eclipse.jetty:jetty-proxy:9.4.58.v20250814
org.eclipse.jetty:jetty-security:9.4.58.v20250814
org.eclipse.jetty:jetty-server:9.4.58.v20250814
org.eclipse.jetty:jetty-servlet:9.4.58.v20250814
org.eclipse.jetty:jetty-servlets:9.4.58.v20250814
org.eclipse.jetty:jetty-util:9.4.58.v20250814
org.eclipse.jetty:jetty-util-ajax:9.4.58.v20250814

Please check and suggest on the impact

Solution

No response

Alternatives

No response

Anything else?

No response

Are you willing to submit a PR?

• I'm willing to submit a PR!

[lhotari]

Since we are using jetty 12.1.12 in pulsar 4.0, Can we get rid of jetty-bom from below modules?

@adarshhm6 I'm not aware of any current way since tiered-storage/file-system and pulsar-io/alluxio require Jetty 9.4.x
The only way to get security fixes for Jetty 9.4.x is to get commercial support and commercial releases, https://www.herodevs.com/support/nes-for-jetty. This isn't an option for Apache Pulsar OSS.

What problem do you have with the Jetty 9 dependencies? If you are concerned about the CVEs, you have the option to not use the components that ship a vulnerable Jetty 9 dependency. The core Pulsar distribution doesn't ship with Jetty 9.
It's very rare that anyone would be using tiered-storage/file-system. The same applies to pulsar-io/alluxio.