Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Gdatasoftwareag
  • Motornet

No data.

No data.

References
Link Providers
https://github.com/GDATASoftwareAG/motornet/commit/b4b6979f5dd7447dd02312e27d766ae2e9d050c2 cve-icon cve-icon
https://github.com/GDATASoftwareAG/motornet/pull/1785 cve-icon cve-icon
https://github.com/GDATASoftwareAG/motornet/releases/tag/v0.19.0 cve-icon cve-icon
https://www.vulncheck.com/advisories/motor-net-kafka-denial-of-service-via-cloudevents-handler cve-icon cve-icon
History

Wed, 04 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Gdatasoftwareag
Gdatasoftwareag motornet
Vendors & Products Gdatasoftwareag
Gdatasoftwareag motornet

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
Title Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping
Weaknesses CWE-755
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-22T19:41:15.973Z

Updated: 2026-11-04T20:20:35.941Z

Reserved: 2026-10-19T14:41:46.700Z

Link: CVE-2026-112331

cve-icon Vulnrichment

Updated: 2026-11-04T20:20:30.720Z

cve-icon NVD

Status : Deferred

Published: 2026-10-22T20:17:05.750

Modified: 2026-11-04T21:17:49.620

Link: CVE-2026-112331

cve-icon Redhat

No data.