Apache Pulsar Reference¶

Look-up facts for Apache Pulsar: release lines and support windows, Java requirements, ports, metadata store URLs, key broker.conf and bookkeeper.conf settings with their defaults, subscription types, authentication providers, protocol handlers, CVEs, and a hardening checklist. For how the pieces fit together, see Explanation. For step-by-step tasks, see How-to Guides.

Provenance

Defaults below come from conf/broker.conf, conf/bookkeeper.conf, and conf/pulsar_env.sh on the branch-4.2 branch of apache/pulsar, checked 2026-09-25. Release dates come from the Pulsar website's release data (data/release-pulsar.js in apache/pulsar-site), cross-checked against the Maven Central pulsar-client version list.

Release Lines and Support Windows¶

Pulsar uses LTS.feature.patch versioning. A major-version bump signals a new LTS line, not a set of breaking changes (release policy).

Release type	Frequency	Active support	Security support
LTS (x.0)	Every 18 months	24 months	36 months
Feature (x.1, x.2, ...)	Every 3 months (target)	6 months	6 months
Patch	When ready	n/a	n/a
Milestone (x.0.0-Mn)	Before an LTS	Not supported, not for production	Not supported

Support windows start from the release date of the line's first release (x.y.0). The Pulsar website computes them with that rule. The table below applies the same rule (status as of 2026-09-25).

Line	Type	First release	Latest release	Active support ends	Security support ends	Status
5.0	Next LTS (milestones)	5.0.0-M1 (2026-06-23)	5.0.0-M2 (tagged 2026-09-12)	n/a	n/a	Preview only. GA "expected later in 2026" (M1 notes)
4.2	Feature	4.2.0 (2026-03-24)	4.2.4 (2026-08-03)	2026-09-24	2026-09-24	Newest feature line. Its computed 6-month window has just ended, and no 4.3 has been released
4.1	Feature	4.1.0 (2025-09-08)	4.1.3 (2026-02-19)	2026-03-08	2026-03-08	Ended
4.0	LTS	4.0.0 (2024-10-21)	4.0.13 (2026-08-03)	2026-10-21	2027-10-21	Supported (the production default)
3.3	Feature	3.3.0 (2024-06-05)	3.3.9 (2025-09-27)	2024-12-05	2024-12-05	Ended
3.0	LTS	3.0.0 (2023-05-02)	3.0.17 (2026-04-23)	2025-05-02	2026-05-02	Ended
2.11 and older	Pre-3.0	-	2.11.4 (2024-03-08)	Ended	Ended	Ended

Upgrade rules

Since 3.0, you can do a live upgrade and downgrade between one LTS and the next. For example, 3.0 -> 4.0 -> 3.0 is supported, but 3.2 -> 5.0 is not.
Before 3.0, upgrades had to go through each feature version in turn (2.8 -> 2.9 -> 2.10).
Upgrade clients and clusters to a supported line before you file issues upstream.

Recent release highlights¶

Release	Highlights (from the release notes)
4.0.0 (2024-10-21)	Enhanced `Key_Shared` implementation (PIP-379 draining hashes), Alpine-based Docker image on Java 21, multi-tenant rate-limiting and QoS work, PIP-366 separate configs for the configuration and local metadata stores. The Oxia metadata plugin (PIP-335) had already landed in 3.3
4.1.0 (2025-09-08)	Batch index ACK enabled by default (PIP-391), broker cache refactor (PIP-430), global topic-level replication policies (PIP-422), third-party schema registry integration hook for clients (PIP-420), BookKeeper 4.17.2
4.2.0 (2026-03-24)	Memory limits for topic-list commands (PIP-442), native OpenTelemetry tracing in the Java client (PIP-446), customizable Prometheus topic labels (PIP-447), metadata store threading rework (PIP-453), Jetty 12, BookKeeper 4.17.3, Oxia client 0.7.x
5.0.0-M1 (2026-06-23)	Scalable Topics (PIP-460), V5 Java client (PIP-466), Oxia as the recommended metadata store, ZooKeeper-to-Oxia live migration (PIP-454), etcd backend removed (PIP-462), IO connectors split out (PIP-465), Gradle build (PIP-463), `javax` to `jakarta` (PIP-472), BookKeeper 4.18.0
5.0.0-M2 (2026-09)	Key_Shared-style consumption for scalable topics (PIP-486), asynchronous v5 auth and TLS plugin interfaces (PIP-478), close inactive topics without deleting data (PIP-470), default JDK 25 for the build. JUL logging config no longer takes effect on the server side

Java Version Requirements¶

From the apache/pulsar README:

Pulsar version	Broker	Functions / IO	CLI	Java client	Docker image runtime
>= 4.1 and master	21	21	17 or 21	17 or 21	21
3.3 to 4.0	21	21	17 or 21	8, 11, 17 or 21	21
2.10 to 3.0	17	17	17	8, 11 or 17	17
2.8 to 2.10	11	11	8 or 11	8 or 11	-

Note

The README recommends a recent patch of Java 17 or 21. JDK-8351933 can cause instability and is fixed in 17.0.17+ and 21.0.8+. The 5.0 milestones also build and run on Java 25.

Default Ports¶

Component	Port	Setting	Notes
Broker binary protocol	6650	`brokerServicePort`	`pulsar://`
Broker binary protocol (TLS)	6651 (convention)	`brokerServicePortTls`	Empty (disabled) by default. `pulsar+ssl://`
Broker HTTP (admin REST, lookups, metrics)	8080	`webServicePort`	`/metrics` for Prometheus
Broker HTTPS	8443 (convention)	`webServicePortTls`	Empty (disabled) by default
Functions worker (standalone mode)	6750 / 6751	`workerPort` / `workerPortTls`	`conf/functions_worker.yml`
BookKeeper bookie	3181	`bookiePort`	Broker-to-bookie data traffic
Bookie HTTP admin	8000	`httpServerPort`	`httpServerEnabled=false` by default
ZooKeeper client	2181	`clientPort`	`conf/zookeeper.conf`
Oxia public / internal	6648 / 6649	Oxia server	Ports used in the Pulsar Helm chart `values.yaml`

Deprecated TLS toggle

tlsEnabled is deprecated. Enable TLS by setting brokerServicePortTls and webServicePortTls.

Metadata Store Backends¶

Backend	URL format	Supported in	Notes
Apache ZooKeeper	`zk:zk1:2181,zk2:2181,zk3:2181`	All versions	Bundled (ZooKeeper 3.9.x in 4.2). Still fully supported in 5.0
Oxia	`oxia://oxia-1:6648/broker`	Plugin since 3.3 (PIP-335). Recommended for new clusters from 5.0	Namespaces must exist in the Oxia coordinator config. Use a separate namespace for BookKeeper
etcd	`etcd:http://etcd-1:2379,...`	Up to 4.x	Removed in 5.0 (PIP-462). Migrate to ZooKeeper or Oxia before you upgrade
RocksDB	`rocksdb://data/metadata`	Standalone / single node only
Local memory	`memory://local`	Standalone / tests only

BookKeeper metadata goes through the Pulsar metadata driver:

Setting	Example
`metadataStoreUrl` (broker)	`oxia://oxia-1.example.com:6648/broker`
`configurationMetadataStoreUrl` (broker)	Optional. Defaults to `metadataStoreUrl`
`bookkeeperMetadataServiceUri` (broker)	`metadata-store:oxia://oxia-1.example.com:6648/bookkeeper`
`metadataServiceUri` (bookie)	`metadata-store:zk:my-zk-1:2181/ledgers` (required to take part in a ZooKeeper-to-Oxia migration)

Broker Configuration Keys¶

Selected broker.conf keys with their branch-4.2 defaults.

Key	Default	Meaning
`metadataStoreUrl`	(empty)	Local metadata store
`configurationMetadataStoreUrl`	(empty, uses `metadataStoreUrl`)	Configuration store (tenants, namespaces, clusters)
`clusterName`	(empty)	This cluster's name
`managedLedgerDefaultEnsembleSize`	`2`	Bookies per ledger (E)
`managedLedgerDefaultWriteQuorum`	`2`	Copies written per entry (Qw)
`managedLedgerDefaultAckQuorum`	`2`	Acks needed before a write completes (Qa)
`managedLedgerCacheSizeMB`	(empty, 1/5 of direct memory)	Broker entry cache
`managedLedgerMaxEntriesPerLedger`	`50000`	Ledger rollover by entries
`managedLedgerMinLedgerRolloverTimeMinutes` / `Max...`	`10` / `240`	Ledger rollover time bounds
`managedLedgerOffloadDriver`	(empty)	`aws-s3`, `google-cloud-storage`, `azureblob`, `filesystem`, ...
`managedLedgerOffloadThresholdInSeconds`	`-1` (off)	Time-based automatic offload
`managedLedgerOffloadAutoTriggerSizeThresholdBytes`	`-1` (off)	Size-based automatic offload
`managedLedgerOffloadDeletionLagMs`	`14400000` (4 h)	Delay before offloaded ledgers are deleted from bookies
`dispatcherMaxRoundRobinBatchSize`	`20`	Shared-subscription dispatch batch
`allowAutoTopicCreationType`	`non-partitioned`	Topic type used for auto-creation
`defaultNumberOfNamespaceBundles`	`4`	Bundles per new namespace
`brokerDeleteInactiveTopicsEnabled`	`true`	Garbage-collect inactive topics
`brokerDeduplicationEnabled`	`false`	Producer message deduplication
`subscriptionTypesEnabled`	`Exclusive,Shared,Failover,Key_Shared`	Allowed subscription types
`systemTopicEnabled` / `topicLevelPoliciesEnabled`	`true` / `true`	System topics and topic-level policies
`enableReplicatedSubscriptions`	`true`	Allow replicated subscriptions for geo-replication
`createTopicToRemoteClusterForReplication`	`true`	Create partitioned-topic metadata on remote clusters
`configurationMetadataSyncEventTopic`	(empty)	Sync configuration metadata across clusters that do not share a store
`backlogQuotaDefaultLimitBytes`	`-1`	Default backlog quota (disabled)
`defaultRetentionTimeInMinutes` / `defaultRetentionSizeInMB`	`0` / `0`	Default retention (none)
`schemaCompatibilityStrategy`	`FULL`	Default schema compatibility
`isAllowAutoUpdateSchemaEnabled`	`true`	Producers may auto-register new schema versions
`loadManagerClassName`	`...ModularLoadManagerImpl`	Load manager. `ExtensibleLoadManagerImpl` is the newer option
`loadBalancerLoadSheddingStrategy`	`...ThresholdShedder`	Load-shedding algorithm
`transactionCoordinatorEnabled`	`false`	Turn on transactions
`functionsWorkerEnabled`	`false`	Run the functions worker inside the broker
`authenticationEnabled` / `authorizationEnabled`	`false` / `false`	Security switches
`authorizationProvider`	`...PulsarAuthorizationProvider`	Role-based authorization
`superUserRoles`	(empty)	Super-user roles
`tlsRequireTrustedClientCertOnConnect`	`false`	Require client certificates (mTLS)
`exposeTopicLevelMetricsInPrometheus`	`true`	Per-topic metrics

JVM memory is set in conf/pulsar_env.sh. The default is PULSAR_MEM="-Xms2g -Xmx2g -XX:MaxDirectMemorySize=4g".

BookKeeper Configuration Keys¶

Key (`bookkeeper.conf`)	Default	Meaning
`bookiePort`	`3181`	Bookie port
`journalDirectories`	(see `journalDirectory`)	Write-ahead journal. Put it on the fastest device
`ledgerDirectories`	`data/bookkeeper/ledgers`	Entry log and index storage
`ledgerStorageClass`	`...DbLedgerStorage`	RocksDB-indexed ledger storage
`journalSyncData`	`true`	fsync the journal before acking. Keep it on in production
`journalMaxGroupWaitMSec`	`1`	Group-commit wait
`gcWaitTime`	`900000` (15 min)	Garbage-collection interval for deleted ledgers
`minorCompactionThreshold` / `majorCompactionThreshold`	`0.2` / `0.5`	Entry-log compaction thresholds
`autoRecoveryDaemonEnabled`	`true`	Run AutoRecovery inside the bookie
`dbStorage_writeCacheMaxSizeMb` / `dbStorage_readAheadCacheMaxSizeMb`	(empty, derived from direct memory)	DbLedgerStorage caches

Transaction Settings¶

From the transactions docs:

Key	Default
`transactionCoordinatorEnabled`	`false`
`transactionLogBatchedWriteEnabled`	`false`
`transactionLogBatchedWriteMaxRecords`	`512`
`transactionLogBatchedWriteMaxSize`	`4194304` (4 MB)
`transactionLogBatchedWriteMaxDelayInMillis`	`1`
`transactionPendingAckBatchedWriteEnabled`	`false`
`transactionBufferSegmentedSnapshotEnabled`	`false`
`transactionBufferSnapshotMaxTransactionCount`	`1000`
`transactionBufferSnapshotMinTimeInMillis`	`5000`

Pulsar transactions provide read-committed isolation. The transaction ID is 128 bits. The top 16 bits identify the transaction coordinator.

Subscription Types¶

Type	Consumers	Ordering	Typical use
Exclusive	One. A second consumer is rejected	Total per partition	Single ordered processor
Failover	One active, others on standby	Total per partition	Ordered processing with HA
Shared	Many, round-robin	None	Work queue
Key_Shared	Many, hash-routed by key	Per key	Parallel processing with per-key order

The V5 client (5.0 milestones) replaces these for scalable topics with StreamConsumer (instead of Exclusive/Failover), QueueConsumer (instead of Shared/Key_Shared), and CheckpointConsumer (no subscription, position tracked by the application, for Flink or Spark).

Authentication Providers¶

Mechanism	Broker provider class	Notes
JWT token	`org.apache.pulsar.broker.authentication.AuthenticationProviderToken`	`tokenSecretKey` (HMAC) or `tokenPublicKey` (RSA/EC). `tokenAudience` pins the audience
mTLS	`org.apache.pulsar.broker.authentication.AuthenticationProviderTls`	Certificate CN becomes the role
OpenID Connect	`org.apache.pulsar.broker.authentication.oidc.AuthenticationProviderOpenID`	Validates IdP-issued JWTs. The client side uses the OAuth 2.0 client-credentials flow
Athenz	`org.apache.pulsar.broker.authentication.AuthenticationProviderAthenz`	Yahoo identity service
Kerberos (SASL)	`org.apache.pulsar.broker.authentication.AuthenticationProviderSasl`
HTTP Basic	`org.apache.pulsar.broker.authentication.AuthenticationProviderBasic`	Dev and test only

pulsar-admin permission actions: produce, consume, sources, sinks, functions, packages. Subscription auth modes (set-subscription-auth-mode): None, Prefix.

Protocol Handlers and Ecosystem Status¶

Component	Status (2026-09)	Source
KoP (Kafka on Pulsar)	Archived by StreamNative. The README points users to "Kafka on StreamNative" (KSN)	streamnative/kop
MoP (MQTT on Pulsar)	Open-source StreamNative protocol handler	streamnative/mop
AoP (AMQP 0-9-1 on Pulsar)	Basic produce and consume only, no transactions. Experimental	streamnative/aop
Pulsar SQL (Presto/Trino)	Removed from apache/pulsar in December 2023 (last shipped in 3.0.x). Extracted to apache/pulsar-sql in October 2024	apache/pulsar-sql
Pulsar IO connectors	In the core repo up to 4.x. Split into a separate repository in 5.0 (PIP-465)	5.0.0-M1 release notes
etcd metadata backend	Removed in 5.0 (PIP-462)	5.0.0-M1 release notes

Kubernetes (Helm Chart)¶

Fact	Value
Chart repo	`helm repo add apachepulsar https://pulsar.apache.org/charts`, chart `apachepulsar/pulsar`
Chart version on master (2026-09-25)	4.7.0, `appVersion` 4.0.12 (the default image follows the 4.0 LTS line)
Minimum Kubernetes	1.25
Metadata store toggle	`components.zookeeper: true` (default) or `components.oxia: true`. With Oxia and no ZooKeeper, Functions need `FileSystemPackagesStorage`
Oxia image in chart	`oxia/oxia:0.16.10`

CVE History (selected)¶

CVE	Component	Summary	Fixed / action
CVE-2025-30677	Pulsar IO Kafka connectors	Sensitive information logged	See advisory. Upgrade connectors
CVE-2024-47561	Avro Java SDK < 1.11.4 (used by the Java client)	Critical RCE through schema parsing	Expedited 3.0.7 and 3.3.2 (2024-10-04). Upgrade Java clients
CVE-2024-29834	Broker admin API	Users with produce or consume permission could run management operations (unload, compaction) on partitioned topics	Upgrade to a supported line
CVE-2024-27317	Functions Worker	Archive-extraction path traversal (CVSS 8.4)	2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1
CVE-2023-37579	Functions Worker	Any authenticated user could read source or sink configs (which may hold credentials)	2.10.4, 2.11.1

The full list is on the Pulsar security page. Security advisories are announced on [email protected].