A vulnerability in datastax pulsar-jms up to version 9.0.3 allows a remote attacker to submit a crafted JMS payload that is processed by the decode function of PulsarObjectMessage.java, leading to deserialization of Java objects. The flaw enables the application to reconstruct objects from untrusted data, which could alter application state or execution flow depending on the deserialized content. The flaw is listed as an insecure deserialization weakness judged by CWE-502.

All installations of datastax pulsar-jms up to and including version 9.0.3 are potentially affected. The vulnerability resides in the PulsarObjectMessage implementation used for message decoding.The affected product is datastax pulsar-jms.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered remotely through the JMS protocol, meaning that an unauthenticated attacker could send a malicious message to a Pulsar client or broker that accepts PulsarObjectMessage types. While no public exploit code is documented, the insecure deserialization pattern is a well‑known high‑risk vector that could be abused if the attacker can precisely craft the payload.