Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck

CVE-2026-112332Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization

High 7.5

In plain English

A high-severity security flaw in motornet from GDATASoftwareAG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 49.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.

Affected products (as reported)

Vendor	Product	Versions
GDATASoftwareAG	motornet	0 – before 0.19.0

Weakness: CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

motornet v0.19.0 Release Notes release-notes, patch
Pull Request issue-tracking, patch
Patch Commit patch
VulnCheck Advisory: Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization third-party-advisory