Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
.NET NuGet

GHSA-jc6x-rj79-w4mx

MEDIUM

GHSA-jc6x-rj79-w4mx is a medium-severity (CVSS 5.9) CWE-347 vulnerability in CoreWCF.Primitives. O3 Security confirms whether GHSA-jc6x-rj79-w4mx is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

CoreWCF: WS-Security signature substitution via document-wide Signature lookup

Also known asCVE-2026-54773
Published
Jun 19, 2026
Updated
Jun 19, 2026
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed

Blast Radius

2 pkgs affected
.NETCoreWCF.Primitives.NETCoreWCF.Primitives

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

Impact

An unauthenticated remote attacker who can place a SOAP header lexically before wsse:Security can embed a ds:Signature of their choosing inside that header and cause the server to verify the attacker-supplied signature instead of the one carried in the security header.

Preconditions

Exploitation requires the endpoint be configured with an endorsing supporting token binding, and the attacker constructs a ds:Signature whose KeyInfo resolves through the receive-side token resolver to a key under the attacker’s control. Both are conditions outside the attacker’s direct control on a generic deployment.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

Use a security token resolver that only accepts references to issuer-pinned X.509 chains (the default when expecting a static set of signing certificates).

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
.NETNuGetCoreWCF.Primitivesall versions1.8.1
.NETNuGetCoreWCF.Primitives≥ 1.9.0&&< 1.9.11.9.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for CoreWCF.Primitives. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update CoreWCF.Primitives to 1.8.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-jc6x-rj79-w4mx is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether GHSA-jc6x-rj79-w4mx is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-jc6x-rj79-w4mx. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact An unauthenticated remote attacker who can place a SOAP header lexically before `wsse:Security` can embed a `ds:Signature` of their choosing inside that header and cause the server to verify the attacker-supplied signature instead of the one carried in the security header. #### Preconditions Exploitation requires the endpoint be configured with an endorsing supporting token binding, and the attacker constructs a `ds:Signature` whose `KeyInfo` resolves through the receive-side token resolver to a key under the attacker’s control. Both are conditions outside the attacker’s direct con
O3 Security · Impact-Aware SCA

Is GHSA-jc6x-rj79-w4mx in your dependencies?

O3 detects GHSA-jc6x-rj79-w4mx across NuGet dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works