{"id":"CVE-2026-111868","kind":"vulnerability","aliases":["CVE-2026-111868"],"related":[],"title":"Pulsar JMS: unsafe deserialization in object messages allows remote attack","description":"A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","summary":"DataStax pulsar-jms up to 9.0.3 deserializes object message content without proper checks in PulsarObjectMessage.decode. A remote attacker who can send crafted messages may trigger the deserialization flaw, and a public exploit exists.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datastax","java","jms","package","pulsar"],"not_affected_if":["no-object-messages","not-using-pulsar-jms"],"how_to_check":"- Check the pulsar-jms version in your build file or dependency tree against `9.0.3`\n- Search your dependency tree for `pulsar-jms` with `mvn dependency:tree` or `gradle dependencies`","fix":"- No fixed version is stated in the sources; unknown\n- Restrict who can publish to the Pulsar topics consumed by JMS object messages until a patch is available","status":"open","published_at":"2026-10-18T01:16:34+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:57:37+00:00","updated_at":"2026-10-25T03:57:37+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:57:37Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is stated in the sources; unknown\n- Restrict who can publish to the Pulsar topics consumed by JMS object messages until a patch is available","reach":"network","title":"Pulsar JMS: unsafe deserialization in object messages allows remote attack","impact":"high","summary":"DataStax pulsar-jms up to 9.0.3 deserializes object message content without proper checks in PulsarObjectMessage.decode. A remote attacker who can send crafted messages may trigger the deserialization flaw, and a public exploit exists.","category":"package","nicknames":[],"who_cares":["java","pulsar","jms","datastax"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker-supplied serialized objects may execute code on the consumer","analyst_note":"Find the upstream advisory or fix commit for pulsar-jms and the fixed version; the NVD entry alone gives no patched release or detailed exploit conditions.","how_to_check":"- Check the pulsar-jms version in your build file or dependency tree against `9.0.3`\n- Search your dependency tree for `pulsar-jms` with `mvn dependency:tree` or `gradle dependencies`","needs_analyst":true,"not_affected_if":["not-using-pulsar-jms","no-object-messages"],"who_is_affected":"Applications that use DataStax pulsar-jms up to 9.0.3 to consume JMS ObjectMessage payloads from Pulsar topics are exposed. Systems that only send text or byte messages, or that do not use this library, are not in the described path. The sources do not say how the decode path is reached in default configurations.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000639,"input_tokens":3366,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111868':13A,16A '-2026':12A,15A '/src/main/java/com/datastax/oss/pulsar/jms/messages/pulsarobjectmessage.java':80C '9.0.3':28B,67C 'affect':70C 'allow':8A 'attack':10A,40B,91C 'caus':83C 'check':35B 'content':32B 'craft':44B 'cve':11A,14A 'datastax':17B,22B,61C 'decod':73C 'deseri':4A,29B,49B,84C 'determin':59C 'disclos':98C 'earli':110C 'exist':55B 'exploit':54B,94C 'file':76C 'flaw':50B 'function':72C 'inform':106C 'initi':89C 'issu':69C,113C 'java':18B 'jms':2A,19B,25B,64C,79C 'manipul':82C 'may':46B,100C 'messag':7A,31B,45B 'object':6A,30B 'packag':20B 'possibl':87C 'problem':109C 'project':104C 'proper':34B 'public':53B,97C 'pulsar':1A,21B,24B,63C,78C 'pulsar-jm':23B,62C,77C 'pulsarobjectmessage.decode':37B 'remot':9A,39B,92C 'report':114C 'respond':118C 'send':43B 'trigger':47B 'unsaf':3A 'util':102C 'vulner':57C 'without':33B 'yet':119C","nicknames":[],"mitigations":[],"who_affected":"Applications that use DataStax pulsar-jms up to 9.0.3 to consume JMS ObjectMessage payloads from Pulsar topics are exposed. Systems that only send text or byte messages, or that do not use this library, are not in the described path. The sources do not say how the decode path is reached in default configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T01:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111868","severity":null,"published_at":"2026-10-18T01:16:34+00:00","modified_at":"2026-10-19T22:17:03+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}