The vulnerability resides in Motor.NET prior to 0.19.0. By sending a single Kafka record with the content‑type header set to application/cloudevents+json and omitting mandatory CloudEvent attributes (id, source, type), a consumer throws an ArgumentException. The framework treats this as a fatal error, causing the host process to terminate; on restart the same malformed record is consumed again, creating an endless crash loop that permanently takes the service offline.

The affected software is the Motor.NET framework produced by GDATASoftwareAG. All releases before 0.19.0 are vulnerable. Any deployment that relies on a Motor.NET consumer connected to a Kafka topic can be hit if an attacker has the ability to write to that topic, which is common in multi‑tenant or public‑facing event streams.

The CVSS base score of 8.7 indicates a high‑severity denial‑of‑service flaw with an external remote attack vector. Because the exploit requires only the construction of a single malformed message, it can be executed automatically, and the damage is irreversible until the vulnerable library is upgraded or the consumer is reconfigured. The EPSS value is not supplied, and the vulnerability is not currently listed in the CISA KEV catalog, but the risk of disruption is substantial for systems that depend on uninterrupted Kafka processing.