Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
Motor.NET, a .NET messaging library, is affected by this flaw, which can let a remote party who is able to publish messages to a queue or topic the service consumes crash the service. The result is a denial of service: the service shuts down and, because the problematic message is redelivered on restart, it can end up repeatedly crashing.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.
Affected versions
- GDATASoftwareAG motornet
fixed in 0.19.0