CVE-2026-112331: Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Motor.NET versions before 0.19.0 are exposed when they consume a Kafka topic to which a remote attacker can produce records. No authentication, user interaction, or elevated privileges are required beyond the ability to write to that consumed topic.
What does an exploit record need to contain?
The attacker sends a record with the content-type header set to application/cloudevents+json while omitting the required CloudEvent attributes id, source, and type. A single such record can trigger the failure.
Why does the service continue failing after a restart?
The exception is treated as fatal and stops the host. On restart, the consumer processes the same poison record again, creating a persistent crash loop until that record is no longer reprocessed.
What version should be deployed to address the issue?
Upgrade Motor.NET to version 0.19.0 or later. Versions earlier than 0.19.0 are affected.