---
id: CVE-2026-54778
title: 'CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution'
summary: 'CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution'
severity: medium
cvss: 6.2
cwe:
  - CWE-362
  - CWE-825
vendor: CoreWCF
product: CoreWCF.UnixDomainSocket
ecosystem: nuget
affected:
  - CoreWCF.UnixDomainSocket < 1.8.1
  - 'CoreWCF.UnixDomainSocket >= 1.9.0, < 1.9.1'
patched:
  - CoreWCF.UnixDomainSocket 1.8.1
  - CoreWCF.UnixDomainSocket 1.9.1
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-q6v9-43v5-jv9q'
references:
  - url: 'https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-q6v9-43v5-jv9q'
  - url: 'https://github.com/advisories/GHSA-q6v9-43v5-jv9q'
tags:
  - ghsa
  - nuget
ingestedAt: '2026-06-22T13:35:24.430Z'
epss: 0.00127
epssPercentile: 0.02022
---

## Overview

### Impact
Race condition in POSIX peer identity resolution may attribute one connection’s identity to another (getpwuid/getgrgid non-reentrant) and may crash the host process under contention.

### Patches
Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds
Restrict UDS filesystem permissions so that only trusted local users can connect to the socket path. The race still exists but the attacker pool is constrained.

## Affected packages

- `CoreWCF.UnixDomainSocket < 1.8.1`
- `CoreWCF.UnixDomainSocket >= 1.9.0, < 1.9.1`

## Remediation

Upgrade to a patched release:

- `CoreWCF.UnixDomainSocket 1.8.1`
- `CoreWCF.UnixDomainSocket 1.9.1`