En resumen
- CVE-2026-54772 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a CoreWCF.NetFramingBase.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.85%, mayor que el 58.3% de las vulnerabilidades.
- Solución: actualizar a 1.9.1, 1.8.1 o posterior.
Description
Impact
An unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU usage can be exhausted.
Preconditions
An attacker being able to reach a service which is exposing an endpoint using one of NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
None
NVD description
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF net.tcp, net.pipe, or net.uds framing handshake and pin one server thread-pool worker at full CPU per connection. This issue is fixed in versions 1.8.1 and 1.9.1.
Más vulnerabilidades de CoreWCF.NetFramingBase
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free