PT-2026-51069 · Nuget · Corewcf.Netframingbase

Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2026-54772

OSV

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact

An unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU usage can be exhausted.

Preconditions

An attacker being able to reach a service which is exposing an endpoint using one of NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

None

Correção

Resource Exhaustion

Infinite Loop

Enumeração de Fraquezas

CWE-400

CWE-835

Identificadores relacionados

CVE-2026-54772

GHSA-P86G-XRR2-PF7C

Produtos afetados

Corewcf.Netframingbase

Referências · 3

• https://github.com/CoreWCF/CoreWCF · Nota
• https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-p86g-xrr2-pf7c · Nota
• https://osv.dev/vulnerability/GHSA-p86g-xrr2-pf7c · Aviso do Fabricante