What is GHSA-p86g-xrr2-pf7c?

GHSA-p86g-xrr2-pf7c is a security advisory published by GitHub Security Advisories with High severity. CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

Which CVE IDs does GHSA-p86g-xrr2-pf7c cover?

GHSA-p86g-xrr2-pf7c covers the following CVE IDs: CVE-2026-54772. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p86g-xrr2-pf7c?

GHSA-p86g-xrr2-pf7c has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-p86g-xrr2-pf7c?

GHSA-p86g-xrr2-pf7c affects 2 products, including: nuget/CoreWCF.NetFramingBase:\u003c 1.8.1; nuget/CoreWCF.NetFramingBase:\u003e= 1.9.0, \u003c 1.9.1.

GHSA-p86g-xrr2-pf7cHighCVSS 7.5

CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

Vendor

GitHub Security Advisories

Published

June 19, 2026

Last Modified

June 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-54772 →

📋 Description

Impact

An unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU usage can be exhausted.

Preconditions

An attacker being able to reach a service which is exposing an endpoint using one of NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

None

🎯 Affected products2

nuget/CoreWCF.NetFramingBase:< 1.8.1
nuget/CoreWCF.NetFramingBase:>= 1.9.0, < 1.9.1

🔗 References (2)

https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-p86g-xrr2-pf7c
https://github.com/advisories/GHSA-p86g-xrr2-pf7c