CoreWCF Pre-auth infinite-loop CPU exhaustion vulnerability (CVE-2026-54772) advisory

Vulnerability Overview Vulnerability Name: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake Vulnerability ID: CVE-2026-54772 Severity: High (7.5 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Scope of Impact Affected Versions: CoreWCF.NetFramingBase (NuGet) 1.8.0, 1.9.0 Impact Description: An unauthenticated remote attacker can keep a server thread pool worker running at 100% CPU usage per connection. With a small number of connections, CPU usage can be exhausted. Prerequisites: The attacker must be able to access a service exposing endpoints via , , or . Remediation Fixed Versions: CoreWCF v1.8.1 and v1.9.1 Patch Information: No specific patch code is provided; upgrading to the aforementioned fixed versions is recommended. Additional Information Workspace: None Weaknesses: - CWE-400 - CWE-835 Key Information Extraction from Page Screenshot Release Date: March 2023 Publisher: mconnew GitHub Repository: CoreWCF/CoreWCF Notifications: 315 Stars: 1.8k Summary This vulnerability involves pre-authentication infinite-loop CPU exhaustion in CoreWCF during the framing handshake process for net.tcp, net.pipe, and net.uds. Attackers can exhaust server CPU resources with a small number of connections, impacting service availability. It is recommended to upgrade to CoreWCF v1.8.1 and v1.9.1 to resolve this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

CoreWCF Pre-auth infinite-loop CPU exhaustion vulnerability (CVE-2026-54772) advisory

More from this source