CVE-2026-111868: datastax pulsar-jms PulsarObjectMessage.java decode deserialization
A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which releases should be considered affected?
The affected range is reported as Datastax pulsar-jms through version 9.0.3. The provided information does not identify a fixed release.
What access does an attacker need to exploit this issue?
The CVSS vector indicates network-based exploitation with low privileges required and no user interaction. The issue can be initiated remotely.
Is there an available vendor response or remediation status?
The project was reportedly notified early through an issue report but had not responded at the time of publication. The supplied information does not describe a patch or workaround.