CVE-2026-111868

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111868

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111868.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111868

Published

2026-10-18T00:15:17Z

Modified

2026-10-20T10:30:51Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

datastax pulsar-jms PulsarObjectMessage.java decode deserialization

Details

A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-20",
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111868.json"
}

References

Affected packages

Git / github.com/datastax/pulsar-jms

Affected ranges

Type

GIT

Repo

https://github.com/datastax/pulsar-jms

Events

Introduced

ae6e56a5d3740d54d48141d55f88f866b557243b

Last Affected

44667a92dda8900d8c9926ed12fdab84a2bd176f

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "9.0.0"
        },
        {
            "last_affected":  "9.0.0"
        },
        {
            "introduced":  "9.0.1"
        },
        {
            "last_affected":  "9.0.1"
        },
        {
            "introduced":  "9.0.2"
        },
        {
            "last_affected":  "9.0.2"
        },
        {
            "introduced":  "9.0.3"
        },
        {
            "last_affected":  "9.0.3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

9.*

9.0.0

9.0.1

9.0.2

9.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111868.json"