Motor.NET CVE-2026-112332

The target must run a Motor.NET service (version <0.19.0) that consumes messages via TypedConsumerService and deserializes payloads with JsonNetDeserializer.Deserialize, and the attacker must be able to publish to a queue or topic that service consumes (e.g., Kafka/SQS/pgmq backend reachable by the attacker). The trigger is explicitly described: sending structurally valid JSON that does not match the handler's expected type, which raises JsonSerializationException - an exception not caught alongside JsonReaderException and InvalidCastException. The limiting factor is publish access to the consumed queue/topic: if the message broker/topic is not reachable or writable by untrusted parties, exploitation is not possible despite the PR:N rating; no user interaction or authentication to Motor.NET itself is required.

Signals are mixed and point to a serious-but-bounded availability issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and describes a low-complexity, network-reachable flaw with no authentication requirement per PR:N, but impact is confined to availability only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure. The vuln.today decision label is 'this_week' (not act_now/emergency), and the flaw is NOT in CISA KEV, so it is not confirmed as actively exploited. No EPSS score was supplied, so statistical exploitation likelihood cannot be quantified, and no PoC or exploit reference is present in the input - only a patch, PR, commit, and a VulnCheck advisory - so this is 'no public exploit identified at time of analysis.' One nuance deserves explicit flagging: although CVSS marks PR:N, the description states the attacker must be able to 'publish to a consumed queue or topic,' which is a real deployment precondition (broker/topic access) that the CVSS vector does not capture - verify whether your message brokers are exposed before treating this as fully unauthenticated. Net: a low-complexity permanent denial-of-service with a severe crash-loop consequence, but against a niche .NET framework and gated by message-publishing access, so prioritize patching for affected services this week rather than as an immediate fire-drill.

An attacker with the ability to publish messages to a queue or topic that a Motor.NET service consumes sends a structurally valid JSON message whose shape does not match the handler's expected type. Deserialization throws an uncaught JsonSerializationException, which TypedConsumerService.SingleMessageConsumeAsync treats as a CriticalFailure and calls StopApplication; because the poison message is left unacknowledged and redelivered on restart, the service enters a permanent crash-loop. No public exploit code is identified in the provided data.