CVE-2026-54772: CoreWCF Denial of Service via Framing Handshake Resource Exhaustion

Technical summary

CoreWCF versions prior to 1.8.1 and 1.9.1 mishandle premature EOF conditions in the framing protocol negotiation phase of NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding endpoints. When an attacker sends a malformed or truncated handshake packet, the affected code path fails to properly release thread-pool resources, causing a worker thread to spin at full CPU utilization. The vulnerability is reachable over the network and does not require authentication, making it exploitable by any actor with network connectivity to the affected endpoint.

Business impact

Availability impact is severe. Attackers can mount low-effort denial-of-service attacks by opening multiple connections and triggering the flaw, exhausting thread-pool capacity and degrading service responsiveness for legitimate users. Organizations running mission-critical CoreWCF services are at risk of unexpected downtime. The attack surface is wide because no authentication is required, and the resource consumption is proportional to the number of connections an attacker can establish, making the impact scalable.

Affected systems

CoreWCF versions 1.8.0 and earlier, and 1.9.0 are affected. Patched versions 1.8.1 and 1.9.1 resolve the issue. Any .NET Core application or microservice using CoreWCF for net.tcp, net.pipe, or net.uds bindings is in scope. Organizations should verify their CoreWCF version and upgrade immediately if running vulnerable versions.

Exploitability

This vulnerability is trivial to exploit. An attacker needs only network access to the endpoint and the ability to send raw protocol frames; no authentication, credentials, or user interaction is required. The attack is reliable and repeatable—each malformed handshake consumes a thread. The CVSS score of 7.5 (HIGH) reflects the combination of network accessibility, low attack complexity, and high availability impact.

Remediation

Update CoreWCF to version 1.8.1 or 1.9.1 or later. These versions include fixes that properly handle EOF conditions during the framing handshake and release thread-pool resources even when the handshake fails. After patching, validate the update in a test environment before production deployment to ensure compatibility with your specific binding configurations.

Patch guidance

Review your CoreWCF dependency version in your project files (csproj or package.json references). If you are on version 1.8.0 or 1.9.0, upgrade to 1.8.1 or 1.9.1 respectively. For applications using dependency pinning or internal package feeds, coordinate with your build and release teams to stage the update. Given the severity of the availability impact and the ease of exploitation, patch deployment should be prioritized within your normal change-management cycle.

Detection guidance

Monitor application thread-pool metrics and CPU utilization for unexpected spikes or sustained high CPU on individual worker threads. NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding endpoints should be instrumented with connection-level logging if available. Watch for repeated connection attempts that disconnect during the handshake phase, which may indicate reconnaissance or attack activity. Network intrusion detection rules should be tuned to flag multiple failed handshakes from a single source within a short window.

Why prioritize this

This vulnerability merits immediate attention despite not yet appearing in public exploit databases. The attack is unauthenticated, network-accessible, requires minimal effort, and causes direct harm to service availability. Organizations hosting CoreWCF endpoints are exposed to scalable DoS attacks from any remote attacker. The fix is straightforward and low-risk, making remediation a high-value activity with low implementation friction.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) appropriately reflects a vulnerability with network-exploitable attack vector, low complexity, no privilege or authentication requirement, and high availability impact. The absence of confidentiality and integrity impact prevents a critical rating. However, in environments where service availability is mission-critical or where thread exhaustion cascades into data loss or system instability, internal risk ratings may justify even higher priority.

Frequently asked questions