CVE-2026-111868: datastax pulsar-jms PulsarObjectMessage.java decode deserialization

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-19
Weakness: CWE-20

Description

A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

datastax pulsar-jms: 9.0.0, 9.0.1, 9.0.2, 9.0.3

References

https://github.com/datastax/pulsar-jms/
https://github.com/datastax/pulsar-jms/issues/210
https://vuldb.com/cve/CVE-2026-111868
https://vuldb.com/submit/1004922
https://vuldb.com/vuln/421580
https://vuldb.com/vuln/421580/cti

Get alerted when CVE-2026-111868 or the next vulnerability affects your stack