Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
Motor.NET, a .NET messaging library, is affected by this vulnerability. A remote attacker who can publish messages to a queue the service consumes can send a specially crafted message that crashes the service, and because the message is redelivered on each restart, the service can be left repeatedly crashing.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.
Affected versions
- GDATASoftwareAG motornet
fixed in 0.19.0