VDB
Sign up
MEDIUM6.5

GHSA-m744-jhq9-ppw6

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

Quick fix

GHSA-m744-jhq9-ppw6 — CoreWCF.Kafka: upgrade to the fixed version with the command below.

dotnet add package CoreWCF.Kafka --version 1.8.1

Details

### Impact A CoreWCF service is running and listening on a Kafka topic receiving a null-value record will stop processing new records from that topic.

#### Preconditions The attacker has produce/write permission on a topic that CoreWCF is consuming from. If the broker permits anonymous publishes, no authentication is required.

### Patches Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds Only allow authenticated writes to a topic

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/CoreWCF.Kafka
Introduced in: 0Fixed in: 1.8.1
Fixdotnet add package CoreWCF.Kafka --version 1.8.1
NuGet/CoreWCF.Kafka
Introduced in: 1.9.0Fixed in: 1.9.1
Fixdotnet add package CoreWCF.Kafka --version 1.9.1

References