CVE-2026-54775

Name of the Vulnerable Software and Affected Versions CoreWCF versions prior to 1.8.1 CoreWCF versions prior to 1.9.1

Description A CoreWCF service listening on a Kafka topic stops processing new records when the KafkaTransportPump receives a null-value tombstone record. A tombstone record is a message in Kafka used to mark the deletion of a key. This results in a persistent endpoint denial of service if an attacker has produce or write permissions on the topic. If the broker allows anonymous publishes, no authentication is required to trigger this state.

Recommendations Update CoreWCF to version 1.8.1. Update CoreWCF to version 1.9.1. Only allow authenticated writes to the Kafka topic.