Infinite loop Affecting corewcf.netframingbase package, versions [,1.8.1)[1.9.0,1.9.1)

Affected versions of this package are vulnerable to Infinite loop through the preamble decode loop in DuplexFramingMiddleware and SingletonFramingMiddleware, with the same end-of-stream handling issue in RawStream.ReadAsyncInternal. An attacker can keep a server connection open indefinitely by sending the 5-byte version-and-mode preamble, then closing the send side before the via record arrives, causing repeated empty completed reads that never advance the handshake. This leaves the connection stuck during channel initialization until the client-side read timeout or external abort, tying up server resources and preventing the Net.TCP endpoint from tearing the connection down promptly.

Notes

• Pre-authentication exposure is limited to services that publish a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint.

• GitHub Advisory
• GitHub Commit
• GitHub Commit