CVE-2026-54775
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service listening on a Kafka topic stops processing new records from that topic when KafkaTransportPump receives a null-value tombstone record, causing a persistent endpoint denial of service for attackers with produce permission. This issue is fixed in versions 1.8.1 and 1.9.1.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.60%
- CWE
- CWE-248, CWE-754, CWE-755
- Published
- 2026-07-08
- Last modified
- 2026-07-09
Affected products
- CoreWCF CoreWCF
- CoreWCF CoreWCF
Weakness type
Related vulnerabilities
- CVE-2026-87123 — hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping
- CVE-2026-88015 — rclone local: crafted Range request against a translated symlink panics (DoS)
- CVE-2026-69839 — Windows iSCSI Target Service Denial of Service Vulnerability
- CVE-2026-82058 — Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service
- CVE-2022-51014 — PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding
- CVE-2022-51009 — PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry
- CVE-2026-19534 — undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- CVE-2026-84947 — undici vulnerable to response truncation via oversized chunked responses in the dump interceptor