CVEvulnerability

CVE-2026-54778

6.2 MEDIUM Published 2026-07-08 Modified 2026-07-09 Official page ↗

Status: Deferred
Published: 2026-07-08
Last modified: 2026-07-09
Assigner: [email protected]
CVSS 3.1 ([email protected]): 6.2 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Weaknesses: CWE-362, CWE-825

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.

Weakness · CWE (2)

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
CWE-825 Expired Pointer Dereference weakness

References

https://github.com/CoreWCF/CoreWCF/commit/a3d95ea4627b818995e92c7def4c016164cacfce github.com
https://github.com/CoreWCF/CoreWCF/commit/b0acb105589b455a095ea5ff49f5191e4eeff791 github.com
https://github.com/CoreWCF/CoreWCF/commit/b4867547c94bb088568935d581a55dda18a621e1 github.com
https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1 github.com
https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1 github.com
https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-q6v9-43v5-jv9q github.com

CVE-2026-54778

Description

Related

Weakness · CWE (2)

References