CVE-2026-111868 is a deserialization flaw in DataStax's pulsar-jms library, up to version 9.0.3, located in the decode handling of its PulsarObjectMessage class. An attacker can trigger it remotely, and a working exploit is already public, yet the maintainers reportedly have not responded despite being notified early.
// source: nvd.nist.gov ↗