diff --git a/apache-pulsar.yaml b/apache-pulsar.yaml
index 97e12349a52..e7f3c83380b 100644
--- a/apache-pulsar.yaml
+++ b/apache-pulsar.yaml
@@ -1,7 +1,7 @@
 package:
   name: apache-pulsar
   version: "4.0.6"
-  epoch: 1
+  epoch: 2 # GHSA-fghv-69vj-qj49
   description: Pulsar is a distributed pub-sub messaging platform with a very flexible messaging model and an intuitive client API.
   copyright:
     - license: Apache-2.0
diff --git a/apache-pulsar/pombump-deps.yaml b/apache-pulsar/pombump-deps.yaml
index 0b05cfd0507..03808ebc0a7 100644
--- a/apache-pulsar/pombump-deps.yaml
+++ b/apache-pulsar/pombump-deps.yaml
@@ -5,3 +5,6 @@ patches:
   - groupId: org.apache.commons
     artifactId: commons-lang3
     version: 3.18.0
+  - groupId: io.netty
+    artifactId: netty-codec-http
+    version: 4.1.125.Final