Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
CVE-2026-112331
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-112331
motornet
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/GDATASoftwareAG/motornet",
"vendor": "GDATASoftwareAG",
"product": "motornet",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.19.0",
"versionType": "semver"
}
],
"packageURL": "pkg:github/GDATASoftwareAG/motornet",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-112331
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #52925 · Revision 1
- Added to Heist Feed
- Publisher date