Loading...
Skip to main content
GeekWala

CVE-2024-28252 — Vulnerability in CoreWCF.NetFramingBase — CVE Details

HIGH

CoreWCF NetFraming based services can leave connections open when they should be closed

Published March 15, 2024Updated September 10, 2026Source: osv

Summary

### Impact If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. There are two scenarios when this can happen. When a client established a connection to the service and sends no data, the service will wait indefinitely for the client to initiate the NetFraming session handshake. Additionally, once a client has established a session, if the client doesn't send any requests for the period of time configured in the binding ReceiveTimeout, the connection is not properly closed as part of the session being aborted. The bindings affected by this behavior are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. Only NetTcpBinding has the ability to accept non local connections. ### Patches The currently supported versions of CoreWCF are v1.4.x and v1.5.x. The fix can be found in v1.4.2 and v1.5.2 of the CoreWCF packages. ### Workarounds There are no workarounds. ### References https://github.com/CoreWCF/CoreWCF/issues/1345

Advisory Timeline

  • First published March 15, 2024 (941 days ago).
  • Last revised September 10, 2026 — 908 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update CoreWCF.NetFramingBase to 1.5.2 or later
dotnet add package CoreWCF.NetFramingBase --version 1.5.2
NuGet
Update CoreWCF.NetFramingBase to 1.4.2 or later
dotnet add package CoreWCF.NetFramingBase --version 1.4.2

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: nuget (1).

PackageEcosystemAffectedFixed In
CoreWCF.NetFramingBase
nuget
1.5.0, 1.5.11.5.2
CoreWCF.NetFramingBase
nuget
1.4.0, 1.4.11.4.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2024-28252?
CoreWCF NetFraming based services can leave connections open when they should be closed This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2024-28252?
CVE-2024-28252 affects CoreWCF.NetFramingBase. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-28252 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-32jq-mv89-5rx7

Related CVEs

  • CVE-2026-106112
    HIGH

    ImageSharp: ICC LUT16 output channel count can write beyond Vector4

  • CVE-2026-106115
    HIGH

    ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

  • CVE-2026-54772
    HIGH

    CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies