---
id: "CVE-2026-111868"
kind: "vulnerability"
aliases: ["CVE-2026-111868"]
title: "Pulsar JMS: unsafe deserialization in object messages allows remote attack"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["datastax", "java", "jms", "package", "pulsar"]
not_affected_if: ["no-object-messages", "not-using-pulsar-jms"]
published_at: "2026-10-18T01:16:34+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:57:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111868", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Pulsar JMS: unsafe deserialization in object messages allows remote attack

DataStax pulsar-jms up to 9.0.3 deserializes object message content without proper checks in PulsarObjectMessage.decode. A remote attacker who can send crafted messages may trigger the deserialization flaw, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the pulsar-jms version in your build file or dependency tree against `9.0.3`
- Search your dependency tree for `pulsar-jms` with `mvn dependency:tree` or `gradle dependencies`

## Fix

- No fixed version is stated in the sources; unknown
- Restrict who can publish to the Pulsar topics consumed by JMS object messages until a patch is available

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111868

## From the sources

A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_