Skip to content
Heist/ feed
High

Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers

Type: advisorySource: Official CVE List1 source record

Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.

Announced Source revision 1
Original source ↗

CVE-2026-112330

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-112330

motornet

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://github.com/GDATASoftwareAG/motornet",
    "vendor": "GDATASoftwareAG",
    "product": "motornet",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.19.0",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:github/GDATASoftwareAG/motornet",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-112330

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#53236 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement