Motor.NET versions prior to 0.19.0 contain a denial‑of‑service flaw that an attacker can trigger by publishing a message with malformed CloudEvents headers. An invalid \"cloudEvents:motorversion\", a single double‑quote header value, or an unparsable typed attribute such as \"cloudEvents:time\" causes an unhandled exception in the ExtractCloudEvent routine, which the application treats as fatal. The resulting crash stops the service; the unacknowledged message is redelivered after restart, leading to a perpetual crash‑loop that halts the service permanently.

GDATASoftwareAG's Motor.NET component is affected. Any deployment of Motor.NET before version 0.19.0 that processes RabbitMQ messages with CloudEvents headers is vulnerable. The issue applies to all supported platforms on which Motor.NET runs, as the flaw is in the core message‑handling library rather than a specific environment.

With a CVSS score of 8.7, this vulnerability is considered high severity. The attack vector requires the attacker to have the ability to publish messages to a queue that Motor.NET consumes; based on the description, it is inferred that once the attacker has achieved publish access, no further authentication is necessary to trigger the failure. The exploit is straightforward, as the application does not perform validation on the header format, and the fault becomes fatal, causing a permanent crash loop. Since the EPSS score is not currently available and the issue is not listed in CISA’s KEV catalog, the likelihood of widespread exploitation is uncertain, but the impact on availability is severe. If an adversary can inject messages, sustained denial‑of‑service can be achieved.