Description
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.
Published: 2026-07-08
Score: 6.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

CoreWCF is a port of the service side of Windows Communication Foundation to .NET Core. In versions prior to 1.8.1 and 1.9.1, the UnixDomainSocket POSIX peer identity resolution relied on non-reentrant getpwuid and getgrgid calls, which can race under concurrent connections, allowing one connection’s identity to be attributed to another or causing the host process to crash under contention. The race condition (CWE-362) together with the misuse of non-reentrant POSIX functions (CWE-825) can lead to identity spoofing or denial of service.

Affected Systems

CoreWCF employs the UnixDomainSocket transport and is vulnerable in versions released before 1.8.1 and 1.9.1. Those releases contain the fix for the non-reentrant identity resolution issue.

Risk and Exploitability

The CVSS score of 6.2 and the EPSS score of <1% along with the absence of a KEV listing imply a low likelihood of exploitation in the wild, but an attacker who can open concurrent UnixDomainSocket connections to a CoreWCF service could cause identity confusion or force the service to crash, impacting confidentiality, integrity, or availability for the affected deployment.

Generated by OpenCVE AI on July 26, 2026 at 16:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade CoreWCF to version 1.8.1 or later in the 1.9.x line where the issue is resolved.
  • If an upgrade cannot be performed immediately, reduce the number of concurrent UnixDomainSocket connections to the service or consider switching to a different transport such as TCP/TLS.
  • Alter any custom code that calls POSIX identity functions to use reentrant alternatives like getpwuid_r and getgrgid_r to prevent race conditions.

Generated by OpenCVE AI on July 26, 2026 at 16:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-q6v9-43v5-jv9q CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
History

Thu, 09 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Corewcf
Corewcf corewcf
Vendors & Products Corewcf
Corewcf corewcf

Wed, 08 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Description CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.
Title CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
Weaknesses CWE-362
CWE-825
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Corewcf Corewcf
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-09T13:23:29.922Z

Reserved: 2026-06-15T23:23:57.714Z

Link: CVE-2026-54778

cve-icon Vulnrichment

Updated: 2026-07-09T13:23:25.331Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T16:45:03Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-825

    Expired Pointer Dereference