CoreWCF.Kafka CVE-2026-54775
MEDIUM
GHSA-m744-jhq9-ppw6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Write access to a Kafka topic is required (PR:L); a single null record halts the endpoint permanently with no confidentiality or integrity impact.
Primary rating from Vendor (https://github.com/CoreWCF/CoreWCF).
CVSS VectorVendor: https://github.com/CoreWCF/CoreWCF
Lifecycle Timeline
2DescriptionCVE.org
Impact
A CoreWCF service is running and listening on a Kafka topic receiving a null-value record will stop processing new records from that topic.
Preconditions
The attacker has produce/write permission on a topic that CoreWCF is consuming from. If the broker permits anonymous publishes, no authentication is required.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
Only allow authenticated writes to a topic
AnalysisAI
Persistent denial-of-service in CoreWCF.Kafka allows any attacker with write access to a consumed Kafka topic to permanently halt message processing by publishing a single null-value (tombstone) record. Affected versions span all CoreWCF.Kafka releases below 1.8.1 and the 1.9.0 release prior to 1.9.1. The consume pump exits without recovery on the uncaught exception, meaning the endpoint remains silently dead until the service process is manually restarted - no exploit code or CISA KEV listing exists at time of analysis.
Technical ContextAI
CoreWCF is the .NET-native port of Windows Communication Foundation, and the CoreWCF.Kafka NuGet package (pkg:nuget/corewcf.kafka) provides an Apache Kafka transport binding that enables CoreWCF services to consume messages from Kafka topics. In Kafka, a tombstone is a producer record with a null value, legitimately used in log-compacted topics to signal key deletion. CWE-248 (Uncaught Exception) identifies the root cause: the CoreWCF.Kafka consume pump does not guard against a null message payload, allowing an unhandled exception to propagate and terminate the consumer polling loop. Because there is no restart or recovery logic wrapping the pump, the goroutine equivalent exits permanently, leaving the Kafka partition unpolled for the lifetime of the service process.
RemediationAI
The primary remediation is to upgrade CoreWCF.Kafka to version 1.8.1 for deployments on the 1.x stable branch, or to version 1.9.1 for deployments on the 1.9.x branch, as confirmed by the vendor advisory at https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-m744-jhq9-ppw6. For environments where an immediate upgrade is not feasible, the vendor-recommended workaround is to restrict Kafka topic write permissions so that only authenticated and authorized producers can publish to any topic consumed by a CoreWCF.Kafka service - this eliminates the anonymous-publish attack vector entirely. Note that this workaround does not protect against a malicious or compromised internal producer that already holds legitimate write credentials; in that scenario, upgrading to the patched version is the only complete mitigation. Implementing broker-level ACLs (e.g., Kafka ACLs, SASL/mTLS enforcement) has no known functional side effects on correctly configured producers.
Same weakness CWE-248 – Uncaught Exception
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today