CVE-2026-54778

MEDIUM6.2

CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

Published Jul 8, 2026

Modified 2 weeks ago

Details

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.

References

WEB

https://github.com/CoreWCF/CoreWCF/commit/a3d95ea4627b818995e92c7def4c016164cacfce

WEB

https://github.com/CoreWCF/CoreWCF/commit/b0acb105589b455a095ea5ff49f5191e4eeff791

WEB

https://github.com/CoreWCF/CoreWCF/commit/b4867547c94bb088568935d581a55dda18a621e1

WEB

https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1

WEB

https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1

WEB