CVE-2026-112331

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112331

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112331.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112331

Published

2026-10-22T19:41:15Z

Modified

2026-11-05T21:15:52Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping

Details

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-755"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112331.json"
}

References

Affected packages

Git / github.com/gdatasoftwareag/motornet

Affected ranges

Type

GIT

Repo

https://github.com/gdatasoftwareag/motornet

Events

Introduced

Fixed

c2eaa0e9ac17b28c1f7b044825c7d60e57a5600e

Fixed

b4b6979f5dd7447dd02312e27d766ae2e9d050c2

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.19.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "v0.19.0",
            "range": [
                {
                    "fixed": "c2eaa0e9ac17b28c1f7b044825c7d60e57a5600e"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "fixed": "b4b6979f5dd7447dd02312e27d766ae2e9d050c2"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

V0.*

V0.9.1

v0.*

v0.1.0

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.6

v0.11.0

v0.11.1

v0.12.0

v0.13.0

v0.13.1

v0.13.2

v0.14.0

v0.14.0-rc1

v0.15.0

v0.15.1

v0.16.1

v0.17.0

v0.18.0

v0.18.1

v0.18.2

v0.19.0-pre1

v0.19.0-pre2

v0.2.0

v0.3.0

v0.4.0

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.6

v0.6.0

v0.6.1

v0.6.10

v0.6.11

v0.6.12

v0.6.13

v0.6.14

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.6.6

v0.6.7

v0.6.8

v0.6.9

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.8.0

v0.8.1

v0.8.2

v0.9.0

v0.9.10

v0.9.11

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112331.json"