Motor.NET: Denial of Service via crafted cloudEvents headers (CVE-2026-112330)
Motor.NET versions before 0.19.0 contain a denial of service vulnerability where crafted cloudEvents headers trigger a fatal exception in ExtractCloudEvent, causing a permanent crash-loop upon message redelivery.
CVE search metadata
CVE search record: CVE-2026-112330. Severity: high. CVSS: 7.5. KEV: no. Product: Motor.NET before 0.19.0 (< 0.19.0). Brief: Motor.NET: Denial of Service via crafted cloudEvents headers (CVE-2026-112330). Brief link: https://feed.craftedsignal.io/briefs/2026-10-motor-net-dos/
Triage facts
Revision 1- Applicability
- Motor.NET before 0.19.0 (< 0.19.0)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 22:30 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Motor.NET before 0.19.0 contains a denial of service vulnerability. A remote attacker who can publish to a consumed queue can crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal. This results in the application stopping and the unacknowledged message being redelivered on restart, causing a permanent crash-loop.