CVE-2026-54775 Details

A denial-of-service vulnerability has been identified in the CoreWCF Kafka transport pump, present in versions 1.8.0 and 1.9.0. When a CoreWCF service consumes a Kafka tombstone record (a legal log-compaction record with a null value), the transport pump halts processing new messages from that topic. This issue arises because the null value causes an ArgumentNullException, which the consume loop's error handling converts into a permanent break, stopping all message processing on the endpoint until the host is restarted. As a result, the service becomes persistently unavailable, creating a denial-of-service condition that can be exploited by any attacker with produce permission on the topic.

Users can upgrade to CoreWCF versions 1.8.1 or 1.9.1, both of which include the necessary fix. Instructions for downloading these versions are available on NuGet.