CoreWCF NetFraming based services can leave connections open when they should be closed
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-404.
Summary
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. There are two scenarios when this can happen. When a client established a connection to the service and sends no data, the service will wait indefinitely for the client to initiate the NetFraming session handshake. Additionally, once a client has established a session, if the client doesn't send any requests for the period of time configured in the binding ReceiveTimeout, the connection is not properly closed as part of the session being aborted. The bindings affected by this behavior are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. Only NetTcpBinding has the ability to accept non local connections. The currently supported versions of CoreWCF are v1.4.x and v1.5.x. The fix can be found in v1.4.2 and v1.5.2 of the CoreWCF packages. Users are advised to upgrade. There are no workarounds for this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CoreWCF | CoreWCF | 1.5.0 to before 1.5.2; before 1.4.2 | 1.5.2, 1.4.2 | Patch available | CNA |
| — | CoreWCF.NetFramingBase (NuGet) | 1.4.0 to before 1.4.2 | 1.4.2 | Patch available | GHSA-32jq-mv89-5rx7 |
| — | CoreWCF.NetFramingBase (NuGet) | 1.5.0 to before 1.5.2 | 1.5.2 | Patch available | GHSA-32jq-mv89-5rx7 |
- CoreWCF VendorCoreWCF Affected 1.5.0 to before 1.5.2; before 1.4.2 Fixed in 1.5.2, 1.4.2 Patch available CNA
- CoreWCF.NetFramingBase (NuGet) Vendor— Affected 1.4.0 to before 1.4.2 Fixed in 1.4.2 Patch available GHSA-32jq-mv89-5rx7
- CoreWCF.NetFramingBase (NuGet) Vendor— Affected 1.5.0 to before 1.5.2 Fixed in 1.5.2 Patch available GHSA-32jq-mv89-5rx7
Remediation
- Fix · CNA CoreWCF (CoreWCF) Fixed in 1.5.2, 1.4.2
- Fix · GHSA-32jq-mv89-5rx7 CoreWCF.NetFramingBase (NuGet) Fixed in 1.4.2 Advisory →
- Fix · GHSA-32jq-mv89-5rx7 CoreWCF.NetFramingBase (NuGet) Fixed in 1.5.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28252
- 2026-10-03 Alias added: GHSA-32jq-mv89-5rx7
References
Sources
- CVE-2024-28252 · CVE Program
- CVE-2024-28252 · NVD
- FIRST EPSS
- GHSA-32jq-mv89-5rx7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences