Motor.NET uses the JsonNetDeserializer for deserializing messages received from a queue or topic. A structural mismatch between the JSON payload and the expected handler type triggers an uncaught JsonSerializationException. Because only JsonReaderException and InvalidCastException are caught, the exception propagates to TypedConsumerService.SingleMessageConsumeAsync, is treated as a CriticalFailure, and causes the application to call StopApplication. The unacknowledged message is then redelivered when the service restarts, creating a permanent crash loop that results in a denial of service.

All releases of GDATASoftwareAG's Motor.NET with a version number lower than 0.19.0 are affected. The vulnerability exists in the core library that handles deserialization; no specific operating system or deployment mode is mentioned, so the impact applies to all environments that use Motor.NET to consume messages.

The CVSS base score of 8.7 indicates a high severity denial of service risk. The EPSS score is not provided, so the current probability of exploitation is not quantified, though the vulnerability is only exploitable by entities that can publish messages to a consumed queue or topic. The CVE is not listed in CISA's KEV, but an attacker could trigger a crash loop by sending a single malicious JSON document. The lack of immediate mitigation beyond stopping the application means the only durable defense is to update to a fixed version or prevent unauthorized writers from publishing to the queue.