CVE-2026-112331

What it is

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of service disruption.

Exploit odds

0.7% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-10-22 20:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-11-04 21:17 UTC Last updatedMost recent change to the record

Details

Published

2026-10-22 20:17 UTC

Last modified

2026-11-04 21:17 UTC

Exploit probability

0.7% · EPSS, next 30 days

Weakness

CWE-755

Record status

Deferred

Attack profile CVSS 4.0 · 8.7

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High