PT-2026-51069 · Nuget · Corewcf.Netframingbase

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-54772

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact

An unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU usage can be exhausted.

Preconditions

An attacker being able to reach a service which is exposing an endpoint using one of NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

None

Fix

Resource Exhaustion

Infinite Loop

Weakness Enumeration

CWE-400

CWE-835

Related Identifiers

CVE-2026-54772

GHSA-P86G-XRR2-PF7C

Affected Products

Corewcf.Netframingbase

References · 3

• https://osv.dev/vulnerability/GHSA-p86g-xrr2-pf7c · Vendor Advisory
• https://github.com/CoreWCF/CoreWCF · Note
• https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-p86g-xrr2-pf7c · Note