Motor.NET: Denial of service via crafted Kafka CloudEvent record
Summary
Motor.NET before 0.19.0 contains a denial-of-service vulnerability in its Kafka consumer. A remote attacker who can produce records to a consumed topic can send a single crafted record with the content type application/cloudevents+json and without the required CloudEvent attributes id, source and type. The service treats the resulting exception as fatal and stops, and because the same record is re-processed on every restart, the service enters a permanent crash loop.
Affected
- Motor.NET versions before 0.19.0 (VulDB describes the range as up to 0.18.x)
- Services that consume Kafka topics with Motor.NET
Fixed in
- Motor.NET 0.19.0
Workaround
- Unknown. No vendor workaround published.
- Restrict which identities can write to the consumed Kafka topics (topic ACLs).
Exploitation
- Unknown. No reports of exploitation in the wild, no CISA KEV listing and no public proof of concept found.
- The trigger is described in the public CVE text.
Our recommendation
- Check whether in-house or partner-built .NET services use Motor.NET, for example via dependency lockfiles.
- Update Motor.NET to version 0.19.0 or later.
- Restrict write access to consumed Kafka topics.
- Monitor consumer services for repeated restarts and remove or skip the poison record if a crash loop occurs.
- No action needed if Motor.NET is not used.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Motor.NET release v0.19.0 github.com
- Fix commit b4b6979 github.com
- Pull request #1785 github.com
- VulnCheck advisory www.vulncheck.com
- Tenable CVE record www.tenable.com
- VulDB entry 425413 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:36.
Original description (NVD)
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
NVD references (4)
- https://github.com/GDATASoftwareAG/motornet/commit/b4b6979f5dd7447dd02312e27d766ae2e9d050c2
- https://github.com/GDATASoftwareAG/motornet/pull/1785
- https://github.com/GDATASoftwareAG/motornet/releases/tag/v0.19.0
- https://www.vulncheck.com/advisories/motor-net-kafka-denial-of-service-via-cloudevents-handler
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.