CVE-2026-112332

HIGH 7.5

Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.

CWE	CWE-755
Vendor	gdatasoftwareag
Product	motornet
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for gdatasoftwareag motornet

Be the first to know when new high vulnerabilities affecting gdatasoftwareag motornet are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

GDATASoftwareAG / motornet

0 < 0.19.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/GDATASoftwareAG/motornet/releases/tag/v0.19.0 github.com: https://github.com/GDATASoftwareAG/motornet/pull/1785 github.com: https://github.com/GDATASoftwareAG/motornet/commit/d5aee7db8e0de3cec95bf8744c499c2ff6019c0c vulncheck.com: https://www.vulncheck.com/advisories/motor-net-denial-of-service-via-jsonnet-deserialization

Credits

Alex Williams from Pellera Technologies