CVE-2026-54778

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54778
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54778.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54778
Aliases
Published
2026-07-08T22:11:55Z
Modified
2026-08-12T03:51:23Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
Summary
CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
Details

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-362",
        "CWE-825"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54778.json"
}
References

Affected packages

Git / github.com/corewcf/corewcf

Affected ranges

Type
GIT
Repo
https://github.com/corewcf/corewcf
Events
Introduced
39b2f02978e497955a560c72b5ccdff5c0dbcda1
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1f7a0811da5128db40fd7b868ae0aac0c581f91f
Fixed
7c0920fe16adc497efae82881ac0f1e4d7ac98d0
Fixed
a3d95ea4627b818995e92c7def4c016164cacfce
Fixed
b0acb105589b455a095ea5ff49f5191e4eeff791
Fixed
b4867547c94bb088568935d581a55dda18a621e1
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.9.0"
        },
        {
            "fixed": "1.9.1"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "1.8.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54778.json"