Apache Pulsar vulnerability