{"id":"CVE-2026-54772","title":"CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake","summary":"CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake","severity":"high","cvss":7.5,"cwe":["CWE-400","CWE-835"],"vendor":"CoreWCF","product":"CoreWCF.NetFramingBase","ecosystem":"nuget","affected":["CoreWCF.NetFramingBase < 1.8.1","CoreWCF.NetFramingBase >= 1.9.0, < 1.9.1"],"patched":["CoreWCF.NetFramingBase 1.8.1","CoreWCF.NetFramingBase 1.9.1"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-p86g-xrr2-pf7c","references":[{"url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-p86g-xrr2-pf7c"},{"url":"https://github.com/advisories/GHSA-p86g-xrr2-pf7c"}],"tags":["ghsa","nuget"],"ingestedAt":"2026-06-22T13:35:24.444Z","epss":0.00848,"epssPercentile":0.56097,"slug":"CVE-2026-54772","body":"## Overview\n\n### Impact\nAn unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU usage can be exhausted.\n\n#### Preconditions\nAn attacker being able to reach a service which is exposing an endpoint using one of NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nNone\n\n## Affected packages\n\n- `CoreWCF.NetFramingBase < 1.8.1`\n- `CoreWCF.NetFramingBase >= 1.9.0, < 1.9.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `CoreWCF.NetFramingBase 1.8.1`\n- `CoreWCF.NetFramingBase 1.9.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}