CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake
Package
Affected versions
< 1.8.1
>= 1.9.0, < 1.9.1
Patched versions
1.8.1
1.9.1
Description
Published to the GitHub Advisory Database
Jun 19, 2026
Reviewed
Jun 19, 2026
Last updated
Jun 19, 2026
Impact
An unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU usage can be exhausted.
Preconditions
An attacker being able to reach a service which is exposing an endpoint using one of NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
None
References