CVE-2026-111868
Received Received - Intake

Deserialization Flaw in DataStax Pulsar-JMS

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description
A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-111868
EUVD
EUVD-2026-103379

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
datastax pulsar-jms 9.0.0
datastax pulsar-jms 9.0.1
datastax pulsar-jms 9.0.2
datastax pulsar-jms 9.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111868 is an insecure deserialization vulnerability in DataStax pulsar-jms up to version 9.0.3. It allows remote code execution when an attacker sends a specially crafted serialized Java object to a Pulsar topic. The vulnerability exists because the library deserializes ObjectMessage payloads without proper class filtering, enabling gadget chains like Commons Collections to execute arbitrary code in the consumer's JVM process.

Detection Guidance

To detect this vulnerability, monitor Pulsar topics for messages with the JMSPulsarMessageType property set to 'object' and analyze payloads for serialized Java objects. Inspect logs for unexpected deserialization events or JVM crashes in consumers. Use network traffic analysis tools to identify suspicious message patterns targeting Pulsar JMS consumers.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code on systems running vulnerable versions of pulsar-jms. An attacker only needs producer access to a Pulsar topic to exploit it, and no user interaction is required. Successful exploitation could lead to full control over the affected system, data breaches, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Apply an ObjectInputFilter to restrict deserializable classes in the pulsar-jms library. Migrate to safer serialization formats like JSON, Avro, or Protobuf. Restrict producer access to Pulsar topics to trusted entities only. Update to the latest patched version if available. Monitor for exploitation attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111868. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart