CVE-2024-28252
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2024-28252 is a vulnerability in CoreWCF, a port of the service side of Windows Communication Foundation (WCF) to .NET Core. The vulnerability allows for the consumption of extra system resources due to connections being left established instead of closing or aborting them. This can occur when a client establishes a connection to the service and sends no data, causing the service to wait indefinitely for the client to initiate the session handshake. Additionally, if a client does not send any requests for the duration specified in the binding ReceiveTimeout, the connection is not properly closed. The affected bindings are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. The vulnerability has a base severity rating of HIGH and poses a potential danger to organizations as it can lead to resource exhaustion and impact availability. The fix for this vulnerability can be found in versions v1.4.2 and v1.5.2 of CoreWCF.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions