Live › vulnerability › CVE-2026-112331
Go to dashboardMotor.NET versions before 0.19.0 let anyone who can write to a consumed Kafka topic send one malformed CloudEvent record. The service treats the resulting exception as fatal and reprocesses the same record on every restart, so it stays down.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the Motor.NET version in your .NET project's package references (for example, the csproj or packages.lock.json) and confirm whether it is below 0.19.0.
0.19.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
This page as .md · .json · in your agent: get_signal("CVE-2026-112331")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.