CVE-2026-112330

The record

Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.

Affected packages

Related vulnerabilities

• CVE-2026-67080 HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper… CWE-755
• CVE-2026-112331 Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote… CWE-755
• CVE-2026-112332 Motor.NET before 0.19.0 contains an uncaught exception vulnerability in… CWE-755
• CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
• CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
• CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755
• CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. CWE-755
• CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful… CWE-755