Junglewise Threat Intelligence

CVE-2026-54775: CoreWCF denial of service via Kafka tombstone record

CVE-2026-54775 · Severity: medium · CVSS 6.5 · Published 2026-07-08

Technologies: CoreWCF. Vendors: CoreWCF.

Executive brief

CoreWCF is a tool used to run Windows-style communication services on modern .NET platforms. A vulnerability exists where sending a specific type of empty message (a Kafka tombstone) can cause the service to stop processing all future messages. This results in a total service outage for that communication channel until the application is manually restarted.

Technical details

A vulnerability in the KafkaTransportPump component of CoreWCF leads to an unhandled ArgumentNullException when a Kafka tombstone record (Message.Value == null) is received. The OnConsumeMessage method fails when attempting to construct a ReadOnlySequence from the null value. Because the main consumption loop's exception handler was configured to break upon encountering an unexpected error, a single tombstone record permanently halts the message pump. Attackers with permission to produce messages to the Kafka topic can trigger this persistent denial of service. The fix involves treating null values as empty arrays and hardening the consumption loop to log-and-continue instead of exiting.

Affected products

  • CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1

Timeline

  • 2026-07-08: advisory: CVE-2026-54775 published
  • 2026-06-16: patched: Fix committed to main branch

References

Related threats