CVE-2026-112330: Improper Handling of Exceptional Conditions in GDATASoftwareAG motornet

CVE-2026-112330 describes a denial of service vulnerability in GDATASoftwareAG's Motor.NET product versions before 0.19.0. An attacker with the ability to publish to a consumed queue can send messages containing malformed cloudEvents headers—such as invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute like cloudEvents:time. These malformed headers trigger an unhandled exception in the ExtractCloudEvent function, which is treated as fatal. This causes the Motor.NET service to stop and enter a crash-loop due to the redelivery of the unacknowledged message on restart, resulting in a permanent denial of service.

The vulnerability allows an unauthenticated remote attacker to cause a permanent denial of service by crashing the Motor.NET service. This disrupts availability as the service repeatedly crashes on restart due to the unhandled exception and message redelivery loop. No other impacts such as data confidentiality or integrity loss are described.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is available, restrict or monitor access to the consumed queues to prevent untrusted parties from publishing messages with crafted cloudEvents headers.