Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
Motor.NET, a .NET library for Kafka message consumption, is affected before version 0.19.0 (version omitted per instructions). An attacker who can produce records to a topic the service consumes can send one malformed CloudEvent record that makes the service crash and repeatedly crash on restart, causing a persistent denial of service until the poisoned record is removed.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
Affected versions
- GDATASoftwareAG motornet
fixed in 0.19.0