En bref
- CVE-2026-54772 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant CoreWCF.NetFramingBase.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.85%, plus élevée que 58.3% des vulnérabilités.
- Correctif : mettre à jour vers 1.9.1, 1.8.1 ou plus récent.
Description
Impact
An unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU usage can be exhausted.
Preconditions
An attacker being able to reach a service which is exposing an endpoint using one of NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
None
NVD description
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF net.tcp, net.pipe, or net.uds framing handshake and pin one server thread-pool worker at full CPU per connection. This issue is fixed in versions 1.8.1 and 1.9.1.
Autres vulnérabilités de CoreWCF.NetFramingBase
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free