CVE-2026-112331

Publié : 22 octobre 2026

Modifié : 22 octobre 2026

Score CVSS

7.5

HIGH

Description détaillée

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Références et Patchs

https://github.com/GDATASoftwareAG/motornet/commit/b4b6979f5dd7447dd02312e27d766ae2e9d050c2 https://github.com/GDATASoftwareAG/motornet/pull/1785 https://github.com/GDATASoftwareAG/motornet/releases/tag/v0.19.0 https://www.vulncheck.com/advisories/motor-net-kafka-denial-of-service-via-cloudevents-handler

Dernières Vulnérabilités

CVE-2026-97785

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

VOIR DÉTAILS

CVE-2026-96616

Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.

VOIR DÉTAILS

CVE-2026-96185

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

VOIR DÉTAILS