CVE-2024-28252

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Mar 15, 2024
Updated: Mar 21, 2024
CWE ID 404

Summary

CVE-2024-28252 is a vulnerability in CoreWCF, a port of the service side of Windows Communication Foundation (WCF) to .NET Core. The vulnerability allows for the consumption of extra system resources due to connections being left established instead of closing or aborting them. This can occur when a client establishes a connection to the service and sends no data, causing the service to wait indefinitely for the client to initiate the session handshake. Additionally, if a client does not send any requests for the duration specified in the binding ReceiveTimeout, the connection is not properly closed. The affected bindings are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. The vulnerability has a base severity rating of HIGH and poses a potential danger to organizations as it can lead to resource exhaustion and impact availability. The fix for this vulnerability can be found in versions v1.4.2 and v1.5.2 of CoreWCF.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-28252 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options