CVE-2026-54772highCWE-400CWE-835

CVE-2026-54772: high-severity vulnerability in CoreWCF

CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

Published · Updated

Follow this CVE+ Monitor CoreWCF+ Monitor CoreWCF.NetFramingBase

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.8%
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF net.tcp, net.pipe, or net.uds framing handshake and pin one server thread-pool worker at full CPU per connection. This issue is fixed in versions 1.8.1 and 1.9.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
CoreWCF · CoreWCF
Related CVEs — CoreWCF

In the same product, most dangerous first.

CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%CVE-2024-28252HIGHCoreWCF NetFraming based services can leave connections open when they should be closedEPSS 0.6%CVE-2026-54779MEDIUMCoreWCF: SAML token replay protection is inoperativeEPSS 0.4%CVE-2026-54782CRITICALCoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validationEPSS 0.4%CVE-2026-54773MEDIUMCoreWCF: WS-Security signature substitution via document-wide Signature lookupEPSS 0.4%CVE-2026-54784HIGHCoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentialityEPSS 0.3%