GitHub Advisoryadvisory · NuGet

GHSA-p86g-xrr2-pf7c CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

HIGH Published 2026-06-19 Modified 2026-06-19 Official page ↗
Aliases
CVE-2026-54772
Ecosystem
NuGet
Packages
CoreWCF.NetFramingBase
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-835
Reviewed
2026-06-19

Affected packages

• NuGet CoreWCF.NetFramingBase: < 1.8.1 → fixed in 1.8.1 • NuGet CoreWCF.NetFramingBase: >= 1.9.0, < 1.9.1 → fixed in 1.9.1

Description

Impact An unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU usage can be exhausted. Preconditions An attacker being able to reach a service which is exposing an endpoint using one of NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding. Patches Fixed in CoreWCF v1.8.1 and v1.9.1 Workarounds None

Related

Alias · CVE (1)

  • CVE-2026-54772 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-835 Loop with Unreachable Exit Condition weakness

References