CoreWCF has 13 CVEs on record. Disclosures have slowed: 0 in the last 90 days after 13 in the 90 before. The busiest recent month was June 2026 with 13. The median CVSS is 6.5 (medium), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-347 (4) and CWE-345 (3). Most affected products: CoreWCF.Primitives (8), CoreWCF.UnixDomainSocket (2), CoreWCF.Kafka (1).

CVEs per month

Weakness classes

Products

Worst active — by depth score

CoreWCF vulnerabilities

CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

CoreWCF: WS-Security signature substitution via document-wide Signature lookup

CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

CoreWCF: SAML token replay protection is inoperative

CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass

CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality