Motor.NET: Denial of service via crafted CloudEvents headers
Summary
Motor.NET before version 0.19.0 can be crashed by a single crafted message on a consumed RabbitMQ queue. An invalid CloudEvents header, such as a malformed cloudEvents:motorversion or cloudEvents:time value, triggers an unhandled exception that the service treats as fatal. The unacknowledged message is redelivered on restart, so the service enters a permanent crash loop. The attacker needs only the ability to publish to a queue that the service consumes.
Affected
- Motor.NET versions before 0.19.0 (GDATASoftwareAG motornet, per the CVE record)
Fixed in
- Motor.NET v0.19.0
Workaround
- No vendor workaround published.
- Restrict which producers can publish to consumed queues until the update is applied (own recommendation, not from the vendor).
Exploitation
- No known exploitation in the wild.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept found in our searches.
Our recommendation
- Update Motor.NET to v0.19.0 or later.
- Check whether any custom or third-party .NET service uses Motor.NET, for example with your development partners.
- Restrict publish permissions on broker queues and review broker credentials.
- Monitor services for repeated restarts or crash loops.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor commit: RabbitMQ reject invalid cloud event headers github.com
- Vendor pull request 1785 github.com
- Motor.NET release v0.19.0 github.com
- VulnCheck advisory: Motor.NET RabbitMQ denial of service www.vulncheck.com
- Tenable: CVE-2026-112330 www.tenable.com
- Strix: CVE-2026-112330 www.strix.ai
- OSV: CVE-2026-112330 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:36.
Original description (NVD)
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.
NVD references (4)
- https://github.com/GDATASoftwareAG/motornet/commit/c45559c78e6925f53e192f8896880a622282effe
- https://github.com/GDATASoftwareAG/motornet/pull/1785
- https://github.com/GDATASoftwareAG/motornet/releases/tag/v0.19.0
- https://www.vulncheck.com/advisories/motor-net-rabbitmq-denial-of-service-via-cloudevents-headers
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.