CVE-2026-112331Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping

Descripción

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• motornet v0.19.0 Release Notes release-notespatch
• Pull Request issue-trackingpatch
• Patch Commit patch
• VulnCheck Advisory: Motor.NET < 0.19.0 Kafka Consumer Permanent DoS via Crafted CloudEvent Record third-party-advisory