HIGH7.5

GHSA-p86g-xrr2-pf7c

CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

Quick fix

GHSA-p86g-xrr2-pf7c — CoreWCF.NetFramingBase: upgrade to the fixed version with the command below.

dotnet add package CoreWCF.NetFramingBase --version 1.8.1

Details

### Impact An unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU usage can be exhausted.

#### Preconditions An attacker being able to reach a service which is exposing an endpoint using one of NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding.

### Patches Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds None

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/CoreWCF.NetFramingBase

Introduced in: 0Fixed in: 1.8.1

Fixdotnet add package CoreWCF.NetFramingBase --version 1.8.1

NuGet/CoreWCF.NetFramingBase

Introduced in: 1.9.0Fixed in: 1.9.1

Fixdotnet add package CoreWCF.NetFramingBase --version 1.9.1

Details

Are you affected?

Affected packages

References