Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112330— Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers

Quick assessment

Affected
GDATASoftwareAG motornet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Motor.NET 0.19.0 之前的版本存在一个拒绝服务（DoS）漏洞。该漏洞允许能够向消费队列发布消息的远程攻击者，通过发送包含精心构造的 CloudEvents 头的消息，永久性地导致服务崩溃。攻击者可以提供无效的 、单个双引号的头部值，或无法解析的 typed 属性（例如 ），从而触发 方法中未处理的异常。该异常被系统视为致命错误，导致应用程序停止运行；重启后，未确认的消息会被重新投递，进而引发持续的崩溃循环（crash-loop）。

CVSS 7.5 · High EPSS 0.63% · P49

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
GDATASoftwareAG motornet < 0.19.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112330

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers
Source: CVE Program / CVE List V5
Vulnerability Description
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对异常条件的处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
GDATASoftwareAG motornet 0 ~ 0.19.0 -

II. Public POCs for CVE-2026-112330

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112330

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112330 (3)

Vendor Advisories for CVE-2026-112330 (1)

Vendor Pages for CVE-2026-112330 (1)

Same Patch Batch · GDATASoftwareAG · 2026-10-22 · 3 CVEs total

CVE-2026-112332 7.5 HIGH Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization
CVE-2026-112331 7.5 HIGH Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping

IV. Related Vulnerabilities

Same product: motornet
Same vendor: GDATASoftwareAG
Same weakness: CWE-755

V. Comments for CVE-2026-112330

No comments yet

Leave a comment