CVE-2026-112332highCWE-755

CVE-2026-112332: high-severity vulnerability in GDATASoftwareAG motornet

Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization

Published · Updated

Follow this CVE+ Monitor motornet

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.6%
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
GDATASoftwareAG · motornet
Related CVEs — GDATASoftwareAG motornet

In the same product, most dangerous first.

CVE-2026-112331HIGHMotor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent MappingEPSS 0.7%CVE-2026-112330HIGHMotor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents HeadersEPSS 0.7%