This message was deleted.

A lot of CVEs are false alarms and these look like such. Python is only used as a language for functions and there is no Apache Httpd server in Pulsar. When some tool reports a CVE against Pulsar, it might not be a real issue. Which tool are you using?

I don’t think those are related to pulsar.

@Lari Hotari we are using anchore (grype) and trivy tools to identify the pulsar cve . Not sure why these tools are giving false alarms 😞 Thanks @Yu Wei Sung @Lari Hotari for replying.

all CVE tools will report false positives. You will have to be able to deal with this.