CVE-2026-54775CWE-248CWE-754CWE-755

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

Medium · published July 8, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
47.9
In the wild
Unconfirmed
What it is

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service listening on a Kafka topic stops processing new records from that topic when KafkaTransportPump receives a null-value tombstone record, causing a persistent endpoint denial of service for attackers with produce permission. This issue is fixed in versions 1.8.1 and 1.9.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00598 · 47.9th percentile
Weaknesses
CWE-248 · Uncaught Exception; CWE-754 · Improper Check for Unusual or Exceptional Conditions; CWE-755 · Improper Handling of Exceptional Conditions
Published
2026-07-08T22:13Z
EPSS history
Timeline
  • 08 JUL 22:13Z
    CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.
    cvelistv5