CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
Impact
CoreWCF’s WS-Security 1.0 receive pipeline validates the SignatureMethod of an incoming ds:SignedInfo against the configured SecurityAlgorithmSuite, but does not validate the DigestMethod declared on each ds:Reference. As a result, a sender can populate ds:SignedInfo with SignatureMethod values the suite accepts (for example rsa-sha256 under Basic256Sha256) while declaring a per-reference DigestMethod the suite rejects (for example http://www.w3.org/2000/09/xmldsig#sha1). The signature is then verified where it permits SHA-1 digests, and the message is accepted.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
None
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | CoreWCF.Primitives | < 1.8.1, >= 1.9.0, < 1.9.1 | 1.8.1, 1.9.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-327, CWE-757- Platform
- .NET (NuGet)
- Package
CoreWCF.Primitives- Disclosed
- 19.06.2026
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4v55-cpmv-3vcm - CC BY 4.0
Vulnerability history: CoreWCF.Primitives
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 06.2026 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 4
- Medium 2
- Low 1
Disclosures per year
- 2026: 8
-
CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.