Uncaught Exception Vulnerability in Motor.NET by GDATASoftwareAG

CVE-2026-112332

What is CVE-2026-112332?

Motor.NET prior to version 0.19.0 is susceptible to an uncaught exception vulnerability present in the JsonNetDeserializer.Deserialize functionality. This issue allows a remote attacker to exploit the service by sending valid JSON data that does not conform to the expected type. The failure to properly catch JsonSerializationException alongside JsonReaderException and InvalidCastException leads to an erroneous handling of the error. Consequently, this triggers the TypedConsumerService.SingleMessageConsumeAsync to encounter a CriticalFailure, resulting in the application stopping and entering a crash-loop state. This vulnerability creates a significant risk of service instability as unacknowledged messages are redelivered upon restart, preventing normal operation.

References