Live › vulnerability › CVE-2026-112330
Go to dashboardMotor.NET (GDATASoftwareAG/motornet) before 0.19.0 throws an unhandled exception in ExtractCloudEvent when a message has malformed cloudEvents headers (invalid cloudEvents:motorversion, a lone double-quote value, or an unparsable typed attribute such as cloudEvents:time). The host treats it as fatal and stops. The unacknowledged message is redelivered on restart, so the service crash-loops until the message is removed. Anyone who can publish to a queue the service consumes can trigger it. CVSS 8.7 (v4) / 7.5 (v3.1), CWE-755. Reported by Alex Williams, Pellera Technologies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Motor.NET | nuget | < 0.19.0 | 0.19.0 |
0.19.0: run dotnet list package or grep PackageReference in *.csproj0.19.0 or later (release v0.19.0, PR #1785 Fix unwanted host shutdown because of broken input)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.
This page as .md · .json · in your agent: get_signal("CVE-2026-112330")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.