Motor.NET: Denial of service via JsonNetDeserializer exception handling (CVE-2026-112332)
Motor.NET versions before 0.19.0 contain an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that can cause a permanent crash-loop.
CVE search metadata
CVE search record: CVE-2026-112332. Severity: high. CVSS: 7.5. KEV: no. Product: Motor.NET (< 0.19.0). Brief: Motor.NET: Denial of service via JsonNetDeserializer exception handling (CVE-2026-112332). Brief link: https://feed.craftedsignal.io/briefs/2026-10-motor-net-deserialization-dos/
Triage facts
Revision 1- Applicability
- Motor.NET (< 0.19.0)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 22:30 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize. A remote attacker who can publish to a consumed queue or topic can crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. The failure to catch JsonSerializationException causes TypedConsumerService.SingleMessageConsumeAsync to call StopApplication; the resulting redelivery of the unacknowledged message on restart leads to a permanent crash-loop.