CVE-2026-112332

Publié : 22 octobre 2026

Modifié : 22 octobre 2026

Score CVSS

7.5

HIGH

Description détaillée

Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Références et Patchs

https://github.com/GDATASoftwareAG/motornet/commit/d5aee7db8e0de3cec95bf8744c499c2ff6019c0c https://github.com/GDATASoftwareAG/motornet/pull/1785 https://github.com/GDATASoftwareAG/motornet/releases/tag/v0.19.0 https://www.vulncheck.com/advisories/motor-net-denial-of-service-via-jsonnet-deserialization

Dernières Vulnérabilités

CVE-2026-97785

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

VOIR DÉTAILS

CVE-2026-96616

Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.

VOIR DÉTAILS

CVE-2026-96185

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

VOIR DÉTAILS