{"id":"CVE-2026-54778","title":"CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution","summary":"CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution","severity":"medium","cvss":6.2,"cwe":["CWE-362","CWE-825"],"vendor":"CoreWCF","product":"CoreWCF.UnixDomainSocket","ecosystem":"nuget","affected":["CoreWCF.UnixDomainSocket < 1.8.1","CoreWCF.UnixDomainSocket >= 1.9.0, < 1.9.1"],"patched":["CoreWCF.UnixDomainSocket 1.8.1","CoreWCF.UnixDomainSocket 1.9.1"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-q6v9-43v5-jv9q","references":[{"url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-q6v9-43v5-jv9q"},{"url":"https://github.com/advisories/GHSA-q6v9-43v5-jv9q"}],"tags":["ghsa","nuget"],"ingestedAt":"2026-06-22T13:35:24.430Z","epss":0.00127,"epssPercentile":0.02756,"slug":"CVE-2026-54778","body":"## Overview\n\n### Impact\nRace condition in POSIX peer identity resolution may attribute one connection’s identity to another (getpwuid/getgrgid non-reentrant) and may crash the host process under contention.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nRestrict UDS filesystem permissions so that only trusted local users can connect to the socket path. The race still exists but the attacker pool is constrained.\n\n## Affected packages\n\n- `CoreWCF.UnixDomainSocket < 1.8.1`\n- `CoreWCF.UnixDomainSocket >= 1.9.0, < 1.9.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `CoreWCF.UnixDomainSocket 1.8.1`\n- `CoreWCF.UnixDomainSocket 1.9.1`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}