CVE-2026-111868 Details
Description
A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in DataStax Pulsar-JMS versions up to 9.0.3, specifically in the 'PulsarObjectMessage' class. The issue arises from insecure deserialization of ObjectMessage payloads, as the library uses 'java.io.ObjectInputStream' to decode messages without any class filtering or type restrictions. This flaw allows an attacker to send a crafted serialized object that, when deserialized by a JMS consumer, executes arbitrary code, leading to remote code execution on the consumer's host.
Users are advised to update to 'pulsar-jms' version 9.0.4 or later, where this vulnerability has been addressed. For versions prior to 9.0.4, apply an 'ObjectInputFilter' to restrict deserialization to a safe allowlist before calling 'readUnshared()'. Alternatively, consider using a safer serialization format, such as JSON or Protobuf, for ObjectMessage transport.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/datastax/pulsar-jms/ | [email protected] | Vendor |
| https://github.com/datastax/pulsar-jms/issues/210 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-111868 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1004922 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421580 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421580/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DataStax pulsar-jms | <= 9.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |