---
id: CVE-2026-54775
title: >-
  CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value
  record), causing persistent endpoint denial of service.
summary: >-
  CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value
  record), causing persistent endpoint denial of service.
severity: medium
cvss: 6.5
cwe:
  - CWE-248
  - CWE-754
  - CWE-755
vendor: CoreWCF
product: CoreWCF.Kafka
ecosystem: nuget
affected:
  - CoreWCF.Kafka < 1.8.1
  - 'CoreWCF.Kafka >= 1.9.0, < 1.9.1'
patched:
  - CoreWCF.Kafka 1.8.1
  - CoreWCF.Kafka 1.9.1
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-m744-jhq9-ppw6'
references:
  - url: 'https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-m744-jhq9-ppw6'
  - url: 'https://github.com/advisories/GHSA-m744-jhq9-ppw6'
tags:
  - ghsa
  - nuget
ingestedAt: '2026-06-22T13:35:24.437Z'
epss: 0.00598
epssPercentile: 0.47043
---

## Overview

### Impact
A CoreWCF service is running and listening on a Kafka topic receiving a null-value record will stop processing new records from that topic.

#### Preconditions
The attacker has produce/write permission on a topic that CoreWCF is consuming from. If the broker permits anonymous publishes, no authentication is required. 

### Patches
Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds
Only allow authenticated writes to a topic

## Affected packages

- `CoreWCF.Kafka < 1.8.1`
- `CoreWCF.Kafka >= 1.9.0, < 1.9.1`

## Remediation

Upgrade to a patched release:

- `CoreWCF.Kafka 1.8.1`
- `CoreWCF.Kafka 1.9.1`