Denial-of-Service Vulnerability in Motor.NET Product by GDATASoftwareAG

CVE-2026-112331

What is CVE-2026-112331?

Motor.NET versions before 0.19.0 are susceptible to a denial-of-service attack. A remote attacker can exploit this vulnerability by sending a specially crafted record to a consumed topic. This exploit involves setting the content-type header to application/cloudevents+json while omitting necessary CloudEvent attributes such as id, source, and type. This can trigger an ArgumentException in the KafkaMessageConsumer.SingleMessageHandlingAsync method, leading to a fatal failure that causes the service to crash and enter a reprocessing loop. The result is a permanent crash that prevents the service from recovering effectively, thus posing a significant disruption risk to users.

References