CVE-2026-112330High· 7.5▾ TwilightMotor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can su…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.
motornet < 0.19.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112331High· 7.5Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping
CVE-2026-112332High· 7.5Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization
CVE-2024-6594High· 7.5Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands
CVE-2023-5090Medium· 6.0A flaw was found in KVM
CVE-2024-21907High· 7.5Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability
CVE-2022-48329Critical· 9.8MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.