Live › vulnerability › CVE-2026-111868
Go to dashboardDataStax pulsar-jms up to 9.0.3 deserializes object message content without proper checks in PulsarObjectMessage.decode. A remote attacker who can send crafted messages may trigger the deserialization flaw, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use DataStax pulsar-jms up to 9.0.3 to consume JMS ObjectMessage payloads from Pulsar topics are exposed. Systems that only send text or byte messages, or that do not use this library, are not in the described path. The sources do not say how the decode path is reached in default configurations.
No product ranges from the sources yet.
9.0.3pulsar-jms with mvn dependency:tree or gradle dependenciesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-111868")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.