CVE-2026-54778
CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
CVSS Score
6.2
EPSS Score
0.0%
EPSS Percentile
0th
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.
| CWE | CWE-362 CWE-825 |
| Vendor | corewcf |
| Product | corewcf |
| Published | Jul 8, 2026 |
| Last Updated | Jul 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for corewcf corewcf
Be the first to know when new medium vulnerabilities affecting corewcf corewcf are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High
Affected Versions
CoreWCF / CoreWCF
>= 1.9.0, < 1.9.1 < 1.8.1
References
github.com: https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-q6v9-43v5-jv9q github.com: https://github.com/CoreWCF/CoreWCF/commit/a3d95ea4627b818995e92c7def4c016164cacfce github.com: https://github.com/CoreWCF/CoreWCF/commit/b0acb105589b455a095ea5ff49f5191e4eeff791 github.com: https://github.com/CoreWCF/CoreWCF/commit/b4867547c94bb088568935d581a55dda18a621e1 github.com: https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1 github.com: https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1