Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112331— Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping

Quick assessment

Affected
GDATASoftwareAG motornet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Motor.NET 在 0.19.0 之前的版本中存在一个拒绝服务漏洞。该漏洞允许能够向消费主题发送记录的远程攻击者，通过发送一条精心构造的记录，永久性地导致服务崩溃。攻击者通过将内容类型（Content-Type）头设置为 ，并省略必需的 CloudEvent 属性（即 id、source 和 type），可触发 方法中的 异常。该异常被视为致命错误，导致宿主进程停止，并在每次重启时重新处理同一条“毒害记录”，从而引发永久性的崩溃循环。

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
GDATASoftwareAG motornet < 0.19.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112331

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping
Source: CVE Program / CVE List V5
Vulnerability Description
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对异常条件的处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
GDATASoftwareAG motornet 0 ~ 0.19.0 -

II. Public POCs for CVE-2026-112331

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112331

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112331 (3)

Vendor Advisories for CVE-2026-112331 (1)

Other References for CVE-2026-112331 (1)

Same Patch Batch · GDATASoftwareAG · 2026-10-22 · 3 CVEs total

CVE-2026-112330 7.5 HIGH Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers
CVE-2026-112332 7.5 HIGH Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization

IV. Related Vulnerabilities

Same product: motornet
Same vendor: GDATASoftwareAG
Same weakness: CWE-755

V. Comments for CVE-2026-112331

No comments yet

Leave a comment