CVE-2026-112330: Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Motor.NETto a version that resolves this vulnerability.Fixed in 0.19.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can exploit it if they can publish messages to a RabbitMQ queue that the vulnerable Motor.NET service consumes. No authentication or user interaction is required by the vulnerability itself, but the attacker needs that queue-publishing capability.
What message content triggers the crash loop?
The affected consumer can be crashed by crafted CloudEvents headers, including an invalid cloudEvents:motorversion value, a header value consisting of a single double quote, or an unparsable typed attribute such as cloudEvents:time. The resulting exception is treated as fatal.
Why does restarting the service not resolve the denial of service?
The crashing message remains unacknowledged and is redelivered when the service restarts. Processing the same message triggers the fatal exception again, creating a persistent crash loop.
What versions are affected and what is the remediation?
Motor.NET versions before 0.19.0 are affected. Upgrade to version 0.19.0 or later.