Denial of Service in CoreWCF via Kafka Tombstone Records

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service listening on a Kafka topic stops processing new records from that topic when KafkaTransportPump receives a null-value tombstone record, causing a persistent endpoint denial of service for attackers with produce permission. This issue is fixed in versions 1.8.1 and 1.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-54775

Affected Vendors & Products

Vendor	Product	Version / Range
corewcf	corewcf	to 1.8.1 (inc)
corewcf	corewcf	to 1.9.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-754	The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CWE-755	The product does not handle or incorrectly handles an exceptional condition.
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects CoreWCF, a port of the Windows Communication Foundation service to .NET Core. Before versions 1.8.1 and 1.9.1, if a CoreWCF service listening on a Kafka topic receives a null-value tombstone record, the KafkaTransportPump component stops processing new records from that topic. This causes the service endpoint to become persistently unavailable, resulting in a denial of service.

Impact Analysis

An attacker with produce permission on the Kafka topic can send a null-value tombstone record that causes the CoreWCF service to stop processing new messages. This leads to a persistent denial of service at the endpoint, disrupting normal service operations and potentially causing downtime or loss of availability.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade CoreWCF to version 1.8.1 or 1.9.1, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-54775. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70