Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112332— Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization

Quick assessment

Affected
GDATASoftwareAG motornet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Motor.NET 0.19.0 之前的版本在 方法中存在一个未捕获的异常漏洞。该漏洞允许能够向消费队列或主题发布消息的远程攻击者，通过发送结构合法但类型与处理器预期不匹配的 JSON 数据，导致服务永久崩溃。 攻击者利用 未被与 和 一同捕获的缺陷，使得 将该错误判定为严重故障（CriticalFailure），并调用 停止应用。由于未确认的消息在重启后会被重新投递，这一机制与上述行为结合，最终导致服务陷入永久崩溃循环（crash-loop）。

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
GDATASoftwareAG motornet < 0.19.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112332

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization
Source: CVE Program / CVE List V5
Vulnerability Description
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对异常条件的处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
GDATASoftwareAG motornet 0 ~ 0.19.0 -

II. Public POCs for CVE-2026-112332

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112332

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112332 (2)

Vendor Pages for CVE-2026-112332 (1)

Same Patch Batch · GDATASoftwareAG · 2026-10-22 · 3 CVEs total

CVE-2026-112330 7.5 HIGH Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers
CVE-2026-112331 7.5 HIGH Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping

IV. Related Vulnerabilities

Same product: motornet
Same vendor: GDATASoftwareAG
Same weakness: CWE-755

V. Comments for CVE-2026-112332

No comments yet

Leave a comment