GitHub Advisoryadvisory · NuGet

GHSA-m744-jhq9-ppw6 CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

MEDIUM Published 2026-06-19 Modified 2026-06-19 Official page ↗
Aliases
CVE-2026-54775
Ecosystem
NuGet
Packages
CoreWCF.Kafka
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248, CWE-754, CWE-755
Reviewed
2026-06-19

Affected packages

• NuGet CoreWCF.Kafka: < 1.8.1 → fixed in 1.8.1 • NuGet CoreWCF.Kafka: >= 1.9.0, < 1.9.1 → fixed in 1.9.1

Description

Impact A CoreWCF service is running and listening on a Kafka topic receiving a null-value record will stop processing new records from that topic. Preconditions The attacker has produce/write permission on a topic that CoreWCF is consuming from. If the broker permits anonymous publishes, no authentication is required. Patches Fixed in CoreWCF v1.8.1 and v1.9.1 Workarounds Only allow authenticated writes to a topic

Related

Alias · CVE (1)

  • CVE-2026-54775 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. vulnerability

Weakness · CWE (3)

  • CWE-248 Uncaught Exception weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

References