# CVE-2026-54775: CoreWCF denial of service via Kafka tombstone record

Source: https://junglewise.ai/threats/cve-2026-54775-corewcf-denial-of-service-via-kafka-tombstone-record  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-54775 · Severity: medium · CVSS 6.5 · Published 2026-07-08

CoreWCF is a tool used to run Windows-style communication services on modern .NET platforms. A vulnerability exists where sending a specific type of empty message (a Kafka tombstone) can cause the service to stop processing all future messages. This results in a total service outage for that communication channel until the application is manually restarted.

Technologies: [CoreWCF](https://junglewise.ai/threats/technologies/corewcf). Vendors: [CoreWCF](https://junglewise.ai/threats/vendors/corewcf), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-54775 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54775 being exploited in the wild.

**How severe is CVE-2026-54775?** Medium severity, with a CVSS score of 6.5, published 8 July 2026.

**Which products and versions are affected?** CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1; CoreWCF.Kafka (NuGet) ECOSYSTEM:introduced=0,fixed=1.8.1.

**Is there a fix for CVE-2026-54775?** Yes. CoreWCF.Kafka (NuGet): upgrade to 1.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54775 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54775?** Check whether you run CoreWCF or CoreWCF.Kafka (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- CoreWCF.Kafka (NuGet): upgrade to 1.8.1 or later

  ```sh
  dotnet add package CoreWCF.Kafka --version 1.8.1
  ```


## Technical details

A vulnerability in the KafkaTransportPump component of CoreWCF leads to an unhandled ArgumentNullException when a Kafka tombstone record (Message.Value == null) is received. The OnConsumeMessage method fails when attempting to construct a ReadOnlySequence from the null value. Because the main consumption loop's exception handler was configured to break upon encountering an unexpected error, a single tombstone record permanently halts the message pump. Attackers with permission to produce messages to the Kafka topic can trigger this persistent denial of service. The fix involves treating null values as empty arrays and hardening the consumption loop to log-and-continue instead of exiting.

## Affected products

- CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1

## Identifiers

- CVE-2026-54775
- GHSA-m744-jhq9-ppw6

## Timeline

- 2026-07-08: advisory: CVE-2026-54775 published
- 2026-06-16: patched: Fix committed to main branch

## References

- [https://github.com/CoreWCF/CoreWCF/commit/1a229d0d14a07766302f7d14c866889f04a3a624](https://github.com/CoreWCF/CoreWCF/commit/1a229d0d14a07766302f7d14c866889f04a3a624)
- [https://github.com/CoreWCF/CoreWCF/commit/6d7431ebc0ebe6521ea6d0dbea8982bac3d2bc98](https://github.com/CoreWCF/CoreWCF/commit/6d7431ebc0ebe6521ea6d0dbea8982bac3d2bc98)
- [https://github.com/CoreWCF/CoreWCF/commit/8f95f3ac3c929409e830b5c5659683ef9f6ea6b0](https://github.com/CoreWCF/CoreWCF/commit/8f95f3ac3c929409e830b5c5659683ef9f6ea6b0)
- [https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1](https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1)
- [https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1](https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1)
- [https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-m744-jhq9-ppw6](https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-m744-jhq9-ppw6)

## Related threats

- [CoreWCF cleartext proof key exposure in SPNEGO negotiation](https://junglewise.ai/threats/cve-2026-54784-corewcf-cleartext-proof-key-exposure-in-spnego-negotiation)
- [CoreWCF signature verification bypass in WS-Security](https://junglewise.ai/threats/cve-2026-54783-corewcf-signature-verification-bypass-in-ws-security)
- [CoreWCF authentication bypass in SAML token validation](https://junglewise.ai/threats/cve-2026-54782-corewcf-authentication-bypass-in-saml-token-validation)
- [CoreWCF improper authentication in SAML SamlSecurityTokenHandler](https://junglewise.ai/threats/cve-2026-54781-corewcf-improper-authentication-in-saml-samlsecuritytokenhandler)
- [CoreWCF algorithm downgrade in WS-Security receive pipeline](https://junglewise.ai/threats/cve-2026-54780-corewcf-algorithm-downgrade-in-ws-security-receive-pipeline)