Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-54778CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

Medium 6.2

In plain English

A medium-severity race condition in CoreWCF from CoreWCF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.1%top 97.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	corewcf.unixdomainsocket	1.8.1	GHSA-q6v9-43v5-jv9q
NuGet	corewcf.unixdomainsocket	1.9.1	GHSA-q6v9-43v5-jv9q

Affected products (as reported)

Vendor	Product	Versions
CoreWCF	CoreWCF	>= 1.9.0, < 1.9.1< 1.8.1

Weakness: CWE-362, CWE-825 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

References

https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-q6v9-43v5-jv9q x_refsource_CONFIRM
https://github.com/CoreWCF/CoreWCF/commit/a3d95ea4627b818995e92c7def4c016164cacfce x_refsource_MISC
https://github.com/CoreWCF/CoreWCF/commit/b0acb105589b455a095ea5ff49f5191e4eeff791 x_refsource_MISC
https://github.com/CoreWCF/CoreWCF/commit/b4867547c94bb088568935d581a55dda18a621e1 x_refsource_MISC
https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1 x_refsource_MISC
https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1 x_refsource_MISC