Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

corewcf.kafka

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5NuGetPublished

    CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

    CVE-2026-54775 · GHSA-m744-jhq9-ppw6

    Affected
    • NuGet corewcf.kafka < 1.8.1; >= 1.9.0, < 1.9.1
    Fixed in
    1.8.11.9.1· Vendor fix available
    Issue
    Impact A CoreWCF service is running and listening on a Kafka topic receiving a null-value record will stop processing new records from that topic. Preconditions The attacker has produce/write permission on a topic that CoreWCF is consuming from. If the broker permits anonymous publishes, no authentication is required. Patches Fixed in CoreWCF v1.8.1 and v1.9.1 Workarounds Only allow authenticated writes to a topic

    Recommended action: Upgrade to 1.9.1 or 1.8.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →