Motornet
Monthly
Permanent denial of service in Motor.NET before 0.19.0: any party able to publish to a queue or topic that a Motor.NET service consumes can crash that service and keep it down. The service deserializes incoming payloads with JsonNetDeserializer.Deserialize, and structurally valid JSON that does not match the handler's expected type raises a JsonSerializationException that the code does not catch, so TypedConsumerService.SingleMessageConsumeAsync classifies the message as a CriticalFailure and calls StopApplication. Because the offending message is never acknowledged, it is redelivered on restart and re-triggers the shutdown, producing a crash-loop that persists until the message is removed or the library is upgraded; the CVSS 4.0 score is 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis.
A single crafted Kafka record can permanently crash-loop a Motor.NET service running any version before 0.19.0 that consumes a topic with CloudEvents message handling. The record declares content-type application/cloudevents+json but omits the mandatory CloudEvent attributes id, source and type, causing an ArgumentException inside KafkaMessageConsumer.SingleMessageHandlingAsync that the framework treats as fatal; the host stops, and because the same poison record is re-consumed on every restart, the service never recovers until the message is removed or the software is upgraded. The authoritative CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) rates this as a high-availability-impact, unauthenticated denial of service with no confidentiality or integrity exposure; the key environmental precondition is that the attacker can produce records to the consumed topic (Kafka-level produce authorization). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 0.19.0 as the complete fix.
Denial of service in Motor.NET before 0.19.0 lets anyone able to publish to a queue the service consumes crash it permanently by sending a message with crafted CloudEvents headers - an invalid cloudEvents:motorversion value, a header whose value is a single double-quote, or an unparsable typed attribute such as cloudEvents:time. The malformed header raises an unhandled exception in ExtractCloudEvent that the host treats as fatal; because the message is never acknowledged, the broker redelivers it after restart and the crash repeats as a permanent crash-loop. The impact is availability-only (CVSS 8.7, VA:H) and requires broker-side publish access rather than authentication to Motor.NET itself; no public exploit was identified at time of analysis.
Permanent denial of service in Motor.NET before 0.19.0: any party able to publish to a queue or topic that a Motor.NET service consumes can crash that service and keep it down. The service deserializes incoming payloads with JsonNetDeserializer.Deserialize, and structurally valid JSON that does not match the handler's expected type raises a JsonSerializationException that the code does not catch, so TypedConsumerService.SingleMessageConsumeAsync classifies the message as a CriticalFailure and calls StopApplication. Because the offending message is never acknowledged, it is redelivered on restart and re-triggers the shutdown, producing a crash-loop that persists until the message is removed or the library is upgraded; the CVSS 4.0 score is 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis.
A single crafted Kafka record can permanently crash-loop a Motor.NET service running any version before 0.19.0 that consumes a topic with CloudEvents message handling. The record declares content-type application/cloudevents+json but omits the mandatory CloudEvent attributes id, source and type, causing an ArgumentException inside KafkaMessageConsumer.SingleMessageHandlingAsync that the framework treats as fatal; the host stops, and because the same poison record is re-consumed on every restart, the service never recovers until the message is removed or the software is upgraded. The authoritative CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) rates this as a high-availability-impact, unauthenticated denial of service with no confidentiality or integrity exposure; the key environmental precondition is that the attacker can produce records to the consumed topic (Kafka-level produce authorization). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 0.19.0 as the complete fix.
Denial of service in Motor.NET before 0.19.0 lets anyone able to publish to a queue the service consumes crash it permanently by sending a message with crafted CloudEvents headers - an invalid cloudEvents:motorversion value, a header whose value is a single double-quote, or an unparsable typed attribute such as cloudEvents:time. The malformed header raises an unhandled exception in ExtractCloudEvent that the host treats as fatal; because the message is never acknowledged, the broker redelivers it after restart and the crash repeats as a permanent crash-loop. The impact is availability-only (CVSS 8.7, VA:H) and requires broker-side publish access rather than authentication to Motor.NET itself; no public exploit was identified at time of analysis.