CVE-2026-112332 GDATASoftwareAG CVE debrief

Who should care

Defenders responsible for Motor.NET deployments, especially in critical infrastructure or exposed to untrusted networks, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-112332 is a high-severity vulnerability in Motor.NET that allows remote attackers to cause a permanent denial of service. Defenders should prioritize patching or mitigating this vulnerability, especially in systems where Motor.NET is used in critical infrastructure or exposed to untrusted networks.

• Potential permanent denial of service
• Crash-loop of the service due to unacknowledged messages
• Need for patching or mitigation to prevent exploitation
• Verification of Motor.NET version and exposure

Technical summary

The vulnerability exists in JsonNetDeserializer.Deserialize, where an uncaught exception allows remote attackers to cause a permanent denial of service by sending structurally valid JSON that does not match the handler's expected type. This issue arises because JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, leading to TypedConsumerService.SingleMessageConsumeAsync treating the error as CriticalFailure and calling StopApplication. As a result, the service crashes permanently due to the unacknowledged message being redelivered on restart, causing a crash-loop. Defenders should prioritize patching or mitigating this vulnerability, especially in systems where Motor.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems where Motor.NET is used in critical infrastructure or exposed to untrusted networks.

Recommended defensive actions

• Patch Motor.NET to version 0.19.0 or later
• Implement input validation and sanitization for JSON data
• Monitor for suspicious JSON payloads
• Consider using a Web Application Firewall (WAF) to detect and prevent attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by an uncaught JsonSerializationException, JsonReaderException, and InvalidCastException in JsonNetDeserializer.Deserialize. This allows attackers to exploit the service by sending malicious JSON, leading to a permanent crash-loop.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.