Read the docs
TI-2024-18811 Aliases CVE-2024-28252GHSA-32jq-mv89-5rx7

CoreWCF NetFraming based services can leave connections open when they should be closed

Priority MEDIUM 40CWE-404Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-404.

Summary

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. There are two scenarios when this can happen. When a client established a connection to the service and sends no data, the service will wait indefinitely for the client to initiate the NetFraming session handshake. Additionally, once a client has established a session, if the client doesn't send any requests for the period of time configured in the binding ReceiveTimeout, the connection is not properly closed as part of the session being aborted. The bindings affected by this behavior are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. Only NetTcpBinding has the ability to accept non local connections. The currently supported versions of CoreWCF are v1.4.x and v1.5.x. The fix can be found in v1.4.2 and v1.5.2 of the CoreWCF packages. Users are advised to upgrade. There are no workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00579 47th percentileScored 2026-11-07
Fix Fixed CoreWCF (CoreWCF): 1.5.2, 1.4.2CoreWCF.NetFramingBase (NuGet): 1.4.2, 1.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CoreWCFCoreWCF1.5.0 to before 1.5.2; before 1.4.21.5.2, 1.4.2Patch availableCNA
—CoreWCF.NetFramingBase (NuGet)1.4.0 to before 1.4.21.4.2Patch availableGHSA-32jq-mv89-5rx7
—CoreWCF.NetFramingBase (NuGet)1.5.0 to before 1.5.21.5.2Patch availableGHSA-32jq-mv89-5rx7
  • CoreWCF VendorCoreWCF Affected 1.5.0 to before 1.5.2; before 1.4.2 Fixed in 1.5.2, 1.4.2 Patch available CNA
  • CoreWCF.NetFramingBase (NuGet) Vendor— Affected 1.4.0 to before 1.4.2 Fixed in 1.4.2 Patch available GHSA-32jq-mv89-5rx7
  • CoreWCF.NetFramingBase (NuGet) Vendor— Affected 1.5.0 to before 1.5.2 Fixed in 1.5.2 Patch available GHSA-32jq-mv89-5rx7

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:corewcf:corewcf:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableCoreWCF
cpe:2.3:a:corewcf:corewcf:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableCoreWCF
  • cpe:2.3:a:corewcf:corewcf:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·CoreWCF
  • cpe:2.3:a:corewcf:corewcf:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·CoreWCF

Remediation

  • Fix · CNA CoreWCF (CoreWCF) Fixed in 1.5.2, 1.4.2
  • Fix · GHSA-32jq-mv89-5rx7 CoreWCF.NetFramingBase (NuGet) Fixed in 1.4.2 Advisory →
  • Fix · GHSA-32jq-mv89-5rx7 CoreWCF.NetFramingBase (NuGet) Fixed in 1.5.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28252
  2. 2026-10-03 Alias added: GHSA-32jq-mv89-5rx7

References

Sources