CoreWCF, a .NET Core port of Windows Communication Foundation, stops processing new Kafka records when it receives a null‑value tombstone, permanently halting the consumer pump until the service restarts. This flaw causes a persistent denial of service on the service endpoint for any client that attempts to use the service after the halt.

The issue affects CoreWCF versions prior to 1.8.1 and 1.9.1, including 1.8.0 and earlier releases. Upgrading to CoreWCF 1.8.1 or later, or CoreWCF 1.9.1 or later, resolves the vulnerability.

The CVSS score of 6.5 indicates medium severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, implying a low exploit probability. Compromise requires an attacker to possess produce permission on the Kafka topic; with that, the attacker can publish a null‑value tombstone record that permanently halts the pump, resulting in a persistent denial of service for all downstream consumers.