CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF net.tcp, net.pipe, or net.uds framing handshake and pin one server thread‑pool worker at full CPU per connection. This issue is fixed in versions 1.8.1 and 1.9.1. The flaw corresponds to CWE‑400 and CWE‑835.

CoreWCF CoreWCF versions older than 1.8.1 and 1.9.1 are affected. Any deployment that exposes NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoints over a network can be impacted.

The CVSS score of 7.5 signals a high‑severity vulnerability. Although the EPSS score is only < 1%, the absence of proven exploitation does not diminish the risk; the flaw, rooted in CWE-400 (Uncontrolled Resource Consumption) and CWE-835 (Infinite Loop), can be triggered by any remote host able to connect to the vulnerable NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoints. The vulnerability is not listed in the CISA KEV catalog, but the attack requires no special credentials, minimal effort, and can be performed from any remote host that can reach the exposed binding. A successful exploitation results in permanent rendering of the affected service unresponsive through sustained CPU exhaustion.