What is the CVSS score of CVE-2026-54772?

CVE-2026-54772 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of CoreWCF are affected by CVE-2026-54772?

CoreWCF.NetFramingBase versions below 1.8.1 contain a denial-of-service vulnerability allowing unauthenticated remote attackers to exhaust server CPU resources by pinning thread-pool workers at 100%…. A patch is available.

How to fix or mitigate CVE-2026-54772?

Within 24 hours: Audit all systems running CoreWCF.NetFramingBase <1.8.1; classify by business criticality and network exposure. Within 7 days: Implement network-layer mitigations-restrict CoreWCF service endpoints (net.tcp, net.pipe, net.uds) to trusted internal networks only via firewall rules and VPC policies; deploy CPU utilization monitoring and alerting on affected hosts. Within 30 days: Deploy CoreWCF.NetFramingBase version 1.8.1 or later once available; conduct patch validation testing and remove interim network controls post-deployment.

CoreWCF CVE-2026-54772

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-19 https://github.com/CoreWCF/CoreWCF

GHSA-p86g-xrr2-pf7c

Denial Of Service

7.5

CVSS 3.1 · Vendor: https://github.com/CoreWCF/CoreWCF

Severity by source

Vendor (https://github.com/CoreWCF/CoreWCF) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable framing endpoint, no auth or user interaction, trivial to send malformed preamble; only availability is impacted, with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/CoreWCF/CoreWCF).

CVSS VectorVendor: https://github.com/CoreWCF/CoreWCF

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 19, 2026 - 21:29 vuln.today

Analysis Generated

Jun 19, 2026 - 21:29 vuln.today

DescriptionCVE.org

Impact

An unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU usage can be exhausted.

Preconditions

An attacker being able to reach a service which is exposing an endpoint using one of NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

None

AnalysisAI

Denial of service in CoreWCF net.tcp, net.pipe, and net.uds framing handshake allows unauthenticated remote attackers to pin a server thread-pool worker at 100% CPU per TCP connection, exhausting CPU resources with only a small number of concurrent connections. Affects CoreWCF.NetFramingBase versions below 1.8.1 and 1.9.0 through 1.9.0, with no public exploit identified at time of analysis. The CVSS 7.5 (High) score reflects pure availability impact reachable pre-authentication over the network.

Technical ContextAI

CoreWCF is the open-source .NET (Core/5+) port of Windows Communication Foundation, maintained by the CoreWCF project on GitHub and distributed via NuGet (CoreWCF.NetFramingBase). The vulnerable code path lives in the .NET Message Framing handshake used by NetTcpBinding, NetNamedPipeBinding, and the newer UnixDomainSocketBinding - all of which share a common framing/preamble negotiation before any WS-* or authentication layer runs. CWE-400 (Uncontrolled Resource Consumption) fits an algorithmic-complexity/infinite-loop bug in that handshake parser: a malformed or crafted framing preamble drives the dispatch loop into a non-terminating state on a thread-pool worker, so each malicious connection permanently consumes one worker thread until the process is restarted.

RemediationAI

Vendor-released patch: upgrade CoreWCF.NetFramingBase to 1.8.1 on the 1.8.x line or 1.9.1 on the 1.9.x line, per the GitHub Security Advisory at https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-p86g-xrr2-pf7c. The advisory explicitly states there are no workarounds, so if patching cannot be performed immediately, the only effective compensating controls are network-layer: restrict reachability of the affected endpoints by firewalling the net.tcp listener port to trusted clients only, terminate net.tcp behind an authenticating reverse proxy or VPN, and for NetNamedPipeBinding / UnixDomainSocketBinding ensure the host machine is not multi-tenant or otherwise exposed to untrusted local users. These controls cost connectivity for legitimate remote consumers and do not stop a local attacker on the host, so they are stopgaps rather than substitutes for the upgrade.