CoreWCF NetFraming based services can leave connections open when they should be closed

Vulnerability

Overview CVE-2024-28252 affects CoreWCF, a .NET Core port of Windows Communication Foundation (WCF). The issue lies in NetFraming-based bindings (NetTcpBinding, NetNamedPipeBinding, UnixDomainSocketBinding) which fail to properly close or abort connections under two conditions: when a client connects but sends no data, and when a client does not send requests within the configured ReceiveTimeout period [1][4]. This leaves connections established indefinitely, consuming extra system resources.

Attack

Vector An attacker can exploit this by establishing a connection and either sending no data or sending requests slower than the ReceiveTimeout, causing the service to hold the connection open indefinitely. Since only NetTcpBinding accepts non-local connections, remote exploitation is possible only via that binding [1][4]. No authentication is required to trigger the resource consumption, as the issue occurs during session handshake or idle session handling.

Impact

Successful exploitation leads to resource exhaustion on the server, as each unclosed connection consumes memory and socket resources. This can degrade service performance or cause denial-of-service (DoS) for legitimate clients [2]. The issue was reported with evidence that the server does not send a TCP RST packet on timeout, leaving clients unaware of the disconnection [2].

Mitigation

CoreWCF versions 1.4.x and 1.5.x are affected; the fix is included in releases 1.4.2 and 1.5.2 [1][3]. Users should upgrade to these versions immediately. There are no workarounds [4].