CVE-2026-54775

6.5 Moyenne

Publiée le 09/07/2026 à 01:16 · Modifiée le 09/07/2026 à 18:29 · Analyse NVD reportée · Source : security-advisories@github.com

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service listening on a Kafka topic stops processing new records from that topic when KafkaTransportPump receives a null-value tombstone record, causing a persistent endpoint denial of service for attackers with produce permission. This issue is fixed in versions 1.8.1 and 1.9.1.

Traduire en français

Produits concernés

CoreWCF

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-248
CWE-754
CWE-755

Références

https://github.com/CoreWCF/CoreWCF/commit/1a229d0d14a07766302f7d14c866889f04a3a624
https://github.com/CoreWCF/CoreWCF/commit/6d7431ebc0ebe6521ea6d0dbea8982bac3d2bc98
https://github.com/CoreWCF/CoreWCF/commit/8f95f3ac3c929409e830b5c5659683ef9f6ea6b0
https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-m744-jhq9-ppw6

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories