Motor.NET CVE-2026-112330

The attacker must be able to publish messages to a queue that a vulnerable Motor.NET instance (any version before 0.19.0) consumes - the VulnCheck advisory frames this around RabbitMQ consumers. The malicious message must carry a specific crafted cloudEvents header, documented as one of: an invalid cloudEvents:motorversion value, a header whose value is a single double-quote, or an unparsable typed attribute such as cloudEvents:time. No authentication to the Motor.NET application itself and no user interaction are required (PR:N/UI:N). The principal limiting factor is broker-side publish authorization: if publish rights to the consumed queue are restricted, exploitation is confined to authorized producers or insiders; on an openly writable queue it is effectively remote and unauthenticated. Only versions below 0.19.0 are affected; updating to 0.19.0 is the vendor fix.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7 High) is driven entirely by availability impact (VA:H) - there is no confidentiality or integrity impact. The signals are internally consistent: a low-complexity, network-reachable, no-privilege/no-interaction flaw whose sole effect is a permanent crash-loop, which matches CWE-755 (improper handling of exceptional conditions). The vuln.today Decision label is 'this_week' - notably NOT act_now or emergency - indicating meaningful but not top-tier urgency. No KEV listing and no EPSS score are provided in the input, and no public exploit reference is listed, so there is no evidence of active exploitation or widespread automated attack; this is a severity-from-impact finding rather than a confirmed in-the-wild threat. The one material caveat is the precondition the CVSS PR:N does not capture: the attacker must be able to publish to a queue the Motor.NET service consumes. In a hardened broker where publish rights are restricted, this narrows realistic exposure to insiders or any upstream producer that can be influenced; on an open or loosely-authorized broker it is effectively remote and trivial. Net assessment: a genuine availability priority (a single crafted message yields a self-perpetuating crash-loop surviving restarts), but its real-world reach depends heavily on who can publish to the consumed queue - align remediation with the 'this_week' decision label.

An attacker with the ability to publish to a RabbitMQ (or other) queue that a Motor.NET service below 0.19.0 consumes sends a single message carrying malformed cloudEvents headers - for example an invalid cloudEvents:motorversion, a lone double-quote header value, or an unparsable cloudEvents:time. ExtractCloudEvent throws an unhandled exception that Motor.NET treats as fatal, stopping the application; because the message was never acknowledged, it is redelivered on restart and immediately crashes the service again, producing a permanent crash-loop. No public exploit code is identified, but the description specifies the exact triggering headers, so weaponization is trivial.