[fix][sec][branch-4.0] Upgrade to Jetty 12.1.8 to address several CVEs - #25534
Merged
Conversation
lhotari
force-pushed
the
branch-4.0-jetty12
branch
from
April 15, 2026 21:32
d28cf5a to
c0eebbd
Compare
lhotari
marked this pull request as draft
April 15, 2026 21:35
Member
Author
|
Marked as draft so that this doesn't get accidentially merged before reviews and CI passing since branch-4.0 doesn't enforce the CI to pass currently. Please review regardless of the draft status. |
lhotari
force-pushed
the
branch-4.0-jetty12
branch
from
April 16, 2026 09:04
c0eebbd to
fc7d391
Compare
lhotari
marked this pull request as ready for review
April 16, 2026 09:05
lhotari
force-pushed
the
branch-4.0-jetty12
branch
2 times, most recently
from
April 16, 2026 10:14
d8f3f7a to
2164559
Compare
Upgrade from Jetty 9.4.58.v20250224 to Jetty 12.1.8 to address multiple CVEs in Jetty 9.4.x: - CVE-2026-5795 (High) - affects <=9.4.60 - CVE-2026-2332 (High) - affects <=9.4.59 - CVE-2025-11143 (Low) - affects <=9.4.58 Jetty 9.4.x is EOL and only receives commercial non-OSS support. This upgrade contains a breaking change in the org.apache.pulsar.broker.web.plugin.servlet.AdditionalServlet interface due to the existing interface coupling directly to Jetty 9 implementation details with the use of org.eclipse.jetty.servlet.ServletHolder class in the AdditionalServlet interface. This coupling has been removed. pulsar-client-auth-athenz requires Java 17+ since it depends on Jetty. The Pulsar Client and Pulsar Admin client remain Java 8+ compatible. (cherry picked from commit 39dbbf0) (cherry picked from commit f5fc992) (cherry picked from commit 7b87a6a)
3 tasks
lhotari
force-pushed
the
branch-4.0-jetty12
branch
from
April 16, 2026 10:41
2164559 to
335583a
Compare
lhotari
marked this pull request as draft
April 16, 2026 10:41
lhotari
marked this pull request as ready for review
April 20, 2026 07:24
manas-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
Apr 23, 2026
apache#25534) (cherry picked from commit e428972)
srinath-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
Apr 23, 2026
apache#25534) (cherry picked from commit e428972)
tuteng
pushed a commit
to streamnative/charts
that referenced
this pull request
May 18, 2026
## Motivation - Pulsar images that include apache/pulsar#25534 no longer include `org.apache.bookkeeper.stats.prometheus.PrometheusMetricsProvider`. - The charts currently render that BookKeeper stats provider by default, which can cause BookKeeper pods to fail with `ClassNotFoundException` when using newer Pulsar images. - The image already carries the appropriate default BookKeeper configuration, so the chart should avoid forcing a provider class. ## Modifications - Removed the default `statsProviderClass` from the BookKeeper common config template. - Removed the default `statsProviderClass` from the BookKeeperCluster template in both `sn-platform` and `sn-platform-slim`. ## Testing - Rendered `sn-platform-slim` with `helm template` and confirmed no `statsProviderClass` or BookKeeper Prometheus provider class is emitted by the rendered BookKeeperCluster.
nodece
pushed a commit
to ascentstream/pulsar
that referenced
this pull request
May 27, 2026
apache#25534) Signed-off-by: Zixuan Liu <nodeces@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Upgrade from Jetty 9.4.58.v20250224 to Jetty 12.1.8 to address multiple CVEs in Jetty 9.4.x:
Jetty 9.4.x is EOL and only receives commercial non-OSS support.
Breaking changes
AdditionalServlet interface change
The
org.apache.pulsar.broker.web.plugin.servlet.AdditionalServletinterface has a breaking change due to the existing interface coupling directly to Jetty 9 implementation details with the use oforg.eclipse.jetty.servlet.ServletHolderclass. This coupling has been removed.Java version requirement for Athenz authentication
pulsar-client-auth-athenzrequires Java 17+ since it depends on Jetty. The Pulsar Client and Pulsar Admin client remain Java 8+ compatible.Configuration changes
The Prometheus metrics provider classes for BookKeeper and ZooKeeper have been relocated. If you are using the previous defaults, update the following settings:
bookkeeper.confstatsProviderClassorg.apache.pulsar.metrics.prometheus.bookkeeper.PrometheusMetricsProviderorg.apache.bookkeeper.stats.prometheus.PrometheusMetricsProviderzookeeper.confmetricsProvider.classNameorg.apache.pulsar.metrics.prometheus.zookeeper.PrometheusMetricsProviderorg.apache.zookeeper.metrics.prometheus.PrometheusMetricsProviderModifications
Upgrades to Jetty 12.1.8 by backporting these changes to branch-4.0:
(cherry picked from commit 39dbbf0) (#25100)
(cherry picked from commit f5fc992) (#25155)
(cherry picked from commit 7b87a6a) (#25169)
Verifying this change
This change is already covered by existing tests.
Does this pull request potentially affect one of the following parts:
Documentation
doc-required