CVE-2026-112330highCWE-755

CVE-2026-112330: high-severity vulnerability in GDATASoftwareAG motornet

Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers

Published · Updated

Follow this CVE+ Monitor motornet

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.7%
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
GDATASoftwareAG · motornet
Related CVEs — GDATASoftwareAG motornet

In the same product, most dangerous first.

CVE-2026-112331HIGHMotor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent MappingEPSS 0.7%CVE-2026-112332HIGHMotor.NET < 0.19.0 Denial of Service via JsonNet DeserializationEPSS 0.6%