CVE-2026-112332: Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Motor.NET deployments before 0.19.0 are exposed when they consume a queue or topic that an attacker can publish to. The attacker does not need credentials beyond whatever access is required to publish the malicious message.
What does an attacker need to send to trigger the crash loop?
The attacker must send structurally valid JSON that does not match the type expected by the message handler. This causes an uncaught JsonSerializationException, which is treated as a critical failure and stops the application.
Why can the service continue failing after it is restarted?
The triggering message remains unacknowledged when the service stops. When the consumer restarts, the message is redelivered and causes the same failure again, resulting in a persistent crash loop.