Pulsar Jms
Monthly
Java deserialization in DataStax pulsar-jms through 9.0.3 allows a low-privileged publisher to trigger unsafe object decoding in consuming JMS clients via crafted ObjectMessage content, potentially causing limited confidentiality, integrity, and availability impact, or code execution when a suitable gadget chain is present. Publicly available exploit code exists, but exploitation requires the consumer to process ObjectMessage payloads and depends on classpath gadgets for meaningful code-execution impact. No vendor-released fixed version is identified, and the project has not responded to the reported issue.
Java deserialization in DataStax pulsar-jms through 9.0.3 allows a low-privileged publisher to trigger unsafe object decoding in consuming JMS clients via crafted ObjectMessage content, potentially causing limited confidentiality, integrity, and availability impact, or code execution when a suitable gadget chain is present. Publicly available exploit code exists, but exploitation requires the consumer to process ObjectMessage payloads and depends on classpath gadgets for meaningful code-execution impact. No vendor-released fixed version is identified, and the project has not responded to the reported issue.