Motor.NET CVE-2026-112331

The target must be a Motor.NET service (version before 0.19.0) consuming a Kafka topic with CloudEvents message handling, and the attacker must be able to produce records to that consumed topic - Kafka-level produce authorization is the key environmental precondition. The crafted record sets the content-type header to application/cloudevents+json and omits the required CloudEvent attributes id, source, and type, which causes an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal. Limiting factors: exploitation needs produce access to the consumed topic and does not require any application-level authentication or user interaction; a single record is sufficient and the effect persists across restarts until the poison record is removed or the service is upgraded. The only complete fix per the vendor is upgrading to 0.19.0.

Severity is driven entirely by availability: the authoritative CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, 8.7) shows a network-reachable, low-complexity, no-privilege, no-interaction flaw whose only impact is VA:H - there is no confidentiality or integrity exposure. What elevates this above a transient DoS is the mechanism: the ArgumentException is treated as fatal, so the host stops and re-reads the same poison record on every restart, producing a permanent crash-loop (CWE-755, improper handling of exceptional conditions). No CISA KEV listing and no EPSS score are provided, so there is no evidence of active or probabilistic widespread exploitation; the signal set is a vendor/VulnCheck advisory plus a 'this_week' priority label rather than 'act_now' or 'emergency'. The one factor the CVSS PR:N does not capture is the real precondition stated in the description - the attacker must be able to produce records to a topic the service consumes, which in most deployments requires Kafka produce authorization; verify your Kafka ACLs to gauge true exposure. Net: a genuine, easily-triggered availability risk for Motor.NET Kafka consumers that warrants prompt patching, but it is gated by topic produce access and carries no data-compromise impact, so it is a this-week priority rather than a drop-everything emergency.

An attacker able to produce messages to a Kafka topic consumed by a Motor.NET service (before 0.19.0) publishes a single record with the content-type header set to application/cloudevents+json while omitting the required CloudEvent attributes id, source, and type. The service throws an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is handled as fatal, the host stops, and on restart it re-consumes the same poison record, resulting in a permanent crash-loop. No public exploit identified at time of analysis, but the trigger is fully described in the VulnCheck advisory.