CoreWCF, a .NET Core port of Windows Communication Foundation, pauses its Kafka consumer when it receives a null‑value tombstone record through KafkaTransportPump, stopping all further record processing. Attackers who have produce permission can publish such a tombstone, causing the service to stop handling new records and leading to a persistent denial of service for downstream consumers. Updating to version 1.8.1 or later, or 1.9.1 or later, resolves the issue.

The issue affects CoreWCF versions prior to 1.8.1 and 1.9.1, including 1.8.0 and earlier releases. Upgrading to CoreWCF 1.8.1 or later, or CoreWCF 1.9.1 or later, resolves the vulnerability.

The CVSS score of 6.5 indicates medium severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, implying a low exploit probability. An attacker must possess produce permission on the Kafka topic; with that, the attacker can publish a null‑value tombstone record that permanently halts the pump, resulting in a persistent denial of service for all downstream consumers.