Read the docs
TI-2026-79514 Aliases CVE-2026-112331

Denial of service in Motor.NET Kafka consumer via crafted record

Priority MEDIUM 45CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

GDATASoftwareAG motornet from 0 before 0.19.0 mishandles exceptional conditions (CWE-755) when consuming Kafka records. A remote attacker who can produce records to a consumed topic sends a single crafted record that triggers an ArgumentException treated as fatal. The host stops and reprocesses the same record on every restart, causing a permanent crash loop.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00679 52nd percentileScored 2026-11-07
Fix Fixed motornet (GDATASoftwareAG): 0.19.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GDATASoftwareAGmotornetbefore 0.19.00.19.0Patch availableCNA
  • motornet VendorGDATASoftwareAG Affected before 0.19.0 Fixed in 0.19.0 Patch available CNA

Remediation

Motor.NET version 0.19.0 fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA motornet (GDATASoftwareAG) Fixed in 0.19.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GDATASoftwareAG motornet 0.19.0

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-79515 Uncaught exception in Motor.NET JSON deserialization enables denial of servicePriority MEDIUM 45
    • TI-2026-79513 Denial of service in Motor.NET RabbitMQ handling via CloudEvents headersPriority MEDIUM 45
    Show all 3 records →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-112331
  2. 2026-10-23 Priority changed: MEDIUM → LOW
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: LOW → MEDIUM

References

Patch 3

  • TI-2026-79515 Uncaught exception in Motor.NET JSON deserialization enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-79513 Denial of service in Motor.NET RabbitMQ handling via CloudEvents headers CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences