CVE-2026-111868 | datastax pulsar-jms up to 9.0.3 PulsarObjectMessage.java decode deserialization (Issue 210)

October 17, 2026 Yanac

A vulnerability marked as critical has been reported in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization.

The identification of this vulnerability is CVE-2026-111868. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More