https://feed.craftedsignal.io/products/motor.net-before-0.19.0--0.19.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 22:30:50 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-motor-net-dos/Thu, 22 Oct 2026 22:30:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-motor-net-dos/Motor.NET versions before 0.19.0 contain a denial of service vulnerability where crafted cloudEvents headers trigger a fatal exception in ExtractCloudEvent, causing a permanent crash-loop upon message redelivery.<p>Motor.NET before 0.19.0 contains a denial of service vulnerability. A remote attacker who can publish to a consumed queue can crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal. This results in the application stopping and the unacknowledged message being redelivered on restart, causing a permanent crash-loop.</p> lowadvisory