CVE-2026-54772

7.5 Élevée

Publiée le 09/07/2026 à 01:16 · Modifiée le 09/07/2026 à 18:29 · Analyse NVD reportée · Source : security-advisories@github.com

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF net.tcp, net.pipe, or net.uds framing handshake and pin one server thread-pool worker at full CPU per connection. This issue is fixed in versions 1.8.1 and 1.9.1.

Traduire en français

Produits concernés

CoreWCF

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-400
CWE-835

Références

https://github.com/CoreWCF/CoreWCF/commit/03ddbced349931a2da6c0efcdf745c0722eff77c
https://github.com/CoreWCF/CoreWCF/commit/7ddd966d6e58564a32ab30c825dd693b45a34a55
https://github.com/CoreWCF/CoreWCF/commit/c4212988cd6fd472783d0413426eeac61044097a
https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-p86g-xrr2-pf7c

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories