CVE-2026-112331 Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping
HighCVSS 8.7
EPSS 0.68%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gdatasoftwareag/motornet | < 0.19.0 | 0.19.0 |
References
- motornet v0.19.0 Release Notes patch release-notes
- Pull Request issue-tracking patch
- Patch Commit patch
- VulnCheck Advisory: Motor.NET < 0.19.0 Kafka Consumer Permanent DoS via Crafted CloudEvent Record third-party-advisory