CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
Priority LOW 27CWE-362Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00127 2nd percentileScored 2026-11-07
Fix Fixed CoreWCF (CoreWCF): 1.9.1, 1.8.1CoreWCF.UnixDomainSocket (NuGet): 1.8.1, 1.9.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CoreWCF | CoreWCF | 1.9.0 to before 1.9.1; before 1.8.1 | 1.9.1, 1.8.1 | Patch available | CNA |
| — | CoreWCF.UnixDomainSocket (NuGet) | before 1.8.1 | 1.8.1 | Patch available | GHSA-q6v9-43v5-jv9q |
| — | CoreWCF.UnixDomainSocket (NuGet) | 1.9.0 to before 1.9.1 | 1.9.1 | Patch available | GHSA-q6v9-43v5-jv9q |
- CoreWCF VendorCoreWCF Affected 1.9.0 to before 1.9.1; before 1.8.1 Fixed in 1.9.1, 1.8.1 Patch available CNA
- CoreWCF.UnixDomainSocket (NuGet) Vendor— Affected before 1.8.1 Fixed in 1.8.1 Patch available GHSA-q6v9-43v5-jv9q
- CoreWCF.UnixDomainSocket (NuGet) Vendor— Affected 1.9.0 to before 1.9.1 Fixed in 1.9.1 Patch available GHSA-q6v9-43v5-jv9q
Remediation
- Fix · CNA CoreWCF (CoreWCF) Fixed in 1.9.1, 1.8.1
- Fix · GHSA-q6v9-43v5-jv9q CoreWCF.UnixDomainSocket (NuGet) Fixed in 1.8.1 Advisory →
- Fix · GHSA-q6v9-43v5-jv9q CoreWCF.UnixDomainSocket (NuGet) Fixed in 1.9.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54778
- 2026-10-03 Alias added: GHSA-q6v9-43v5-jv9q
References
Other 7
- https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-q6v9-43v5-jv9q
- https://github.com/CoreWCF/CoreWCF/commit/a3d95ea4627b818995e92c7def4c016164cacfce
- https://github.com/CoreWCF/CoreWCF/commit/b0acb105589b455a095ea5ff49f5191e4eeff791
- https://github.com/CoreWCF/CoreWCF/commit/b4867547c94bb088568935d581a55dda18a621e1
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
- https://github.com/CoreWCF/CoreWCF
More CoreWCF vulnerabilities
- TI-2026-39588 CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation CVSS 3.1CRITICAL 10.0
- TI-2026-39578 CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake CVSS 3.1HIGH 7.5
- TI-2024-18811 CoreWCF NetFraming based services can leave connections open when they should be closed CVSS 3.1HIGH 7.5
- TI-2026-39590 CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality CVSS 3.1HIGH 7.4
- TI-2026-39589 Authentication bypass by capture-replay in CoreWCF CVSS 3.1HIGH 7.4
- TI-2026-39587 CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced CVSS 3.1HIGH 7.4
Sources
- CVE-2026-54778 · CVE Program
- CVE-2026-54778 · NVD
- FIRST EPSS
- GHSA-q6v9-43v5-jv9q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences