CVE-2026-54775: CoreWCF denial of service via Kafka tombstone record

CVE-2026-54775 · Severity: medium · CVSS 6.5 · Published 2026-07-08

CoreWCF is a tool used to run Windows-style communication services on modern .NET platforms. A vulnerability exists where sending a specific type of empty message (a Kafka tombstone) can cause the service to stop processing all future messages. This results in a total service outage for that communication channel until the application is manually restarted.

Technologies: CoreWCF. Vendors: CoreWCF, NuGet.

Quick answers

Is CVE-2026-54775 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54775 being exploited in the wild.
How severe is CVE-2026-54775?
Medium severity, with a CVSS score of 6.5, published 8 July 2026.
Which products and versions are affected?
CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1; CoreWCF.Kafka (NuGet) ECOSYSTEM:introduced=0,fixed=1.8.1.
Is there a fix for CVE-2026-54775?
Yes. CoreWCF.Kafka (NuGet): upgrade to 1.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54775 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54775?
Check whether you run CoreWCF or CoreWCF.Kafka (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • CoreWCF.Kafka (NuGet): upgrade to 1.8.1 or later
    dotnet add package CoreWCF.Kafka --version 1.8.1

Technical details

A vulnerability in the KafkaTransportPump component of CoreWCF leads to an unhandled ArgumentNullException when a Kafka tombstone record (Message.Value == null) is received. The OnConsumeMessage method fails when attempting to construct a ReadOnlySequence from the null value. Because the main consumption loop's exception handler was configured to break upon encountering an unexpected error, a single tombstone record permanently halts the message pump. Attackers with permission to produce messages to the Kafka topic can trigger this persistent denial of service. The fix involves treating null values as empty arrays and hardening the consumption loop to log-and-continue instead of exiting.

Affected products

  • CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1

Identifiers

  • CVE-2026-54775
  • GHSA-m744-jhq9-ppw6

Timeline

  • 2026-07-08: advisory: CVE-2026-54775 published
  • 2026-06-16: patched: Fix committed to main branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.