CVE-2026-54772
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated r
CVSS
7.5
High
EPSS
0.5%
p38
KEV
—
Exploit Today
11
0-100
Published: Jul 8, 2026 · Last modified: Jul 9, 2026 · CWE-400 · CWE-835
0.5%EPSS · 30 days0.5%
2026-07-092026-07-17
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF net.tcp, net.pipe, or net.uds framing handshake and pin one server thread-pool worker at full CPU per connection. This issue is fixed in versions 1.8.1 and 1.9.1.
- github.comhttps://github.com/CoreWCF/CoreWCF/commit/03ddbced349931a2da6c0efcdf745c0722eff77c
- github.comhttps://github.com/CoreWCF/CoreWCF/commit/7ddd966d6e58564a32ab30c825dd693b45a34a55
- github.comhttps://github.com/CoreWCF/CoreWCF/commit/c4212988cd6fd472783d0413426eeac61044097a
- github.comhttps://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
- github.comhttps://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
- github.comhttps://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-p86g-xrr2-pf7c
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-48907.5 HIG93.6%
——28A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.3dCVE-2025-594657.5 HIG88.8%
——27A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```3dCVE-2026-238647.5 HIG82.9%
——25Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.3dCVE-2026-455917.5 HIG82.4%
——25Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.3dCVE-2026-428997.5 HIG82.4%
——25Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.3dCVE-2026-331167.5 HIG80.0%
——24Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.3d