CVE-2026-112331

The record

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.

Affected packages

Related vulnerabilities

• CVE-2026-67080 HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper… CWE-755
• CVE-2026-112330 Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote… CWE-755
• CVE-2026-112332 Motor.NET before 0.19.0 contains an uncaught exception vulnerability in… CWE-755
• CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
• CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
• CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755
• CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. CWE-755
• CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful… CWE-755