GitHub Advisoryadvisory · NuGet

GHSA-q6v9-43v5-jv9q CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

MEDIUM Published 2026-06-19 Modified 2026-06-19 Official page ↗
Aliases
CVE-2026-54778
Ecosystem
NuGet
Packages
CoreWCF.UnixDomainSocket
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Weaknesses
CWE-362, CWE-825
Reviewed
2026-06-19

Affected packages

• NuGet CoreWCF.UnixDomainSocket: < 1.8.1 → fixed in 1.8.1 • NuGet CoreWCF.UnixDomainSocket: >= 1.9.0, < 1.9.1 → fixed in 1.9.1

Description

Impact Race condition in POSIX peer identity resolution may attribute one connection’s identity to another (getpwuid/getgrgid non-reentrant) and may crash the host process under contention. Patches Fixed in CoreWCF v1.8.1 and v1.9.1 Workarounds Restrict UDS filesystem permissions so that only trusted local users can connect to the socket path. The race still exists but the attacker pool is constrained.

Related

Alias · CVE (1)

  • CVE-2026-54778 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-825 Expired Pointer Dereference weakness

References