CVE-2026-54776mediumCWE-306

CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.4epss 0.1%

probabilidade de exploração

0.1%top 99% das CVEs

exploração observada

nãonenhuma fonte reporta

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets with PosixIdentity client credentials can accept connections that skip the application/unixposix stream upgrade before dispatching messages, bypassing framing-layer identity checks in UnixPosixIdentitySecurityUpgradeProvider. This issue is fixed in versions 1.8.1 and 1.9.1.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Produtos afetados

CoreWCF · CoreWCF

Referências

https://github.com/CoreWCF/CoreWCF/commit/994431268e3362c0cd126450fe2a135c202551f3 https://github.com/CoreWCF/CoreWCF/commit/9af16955e51a57348dafce0019e259a092ef7440 https://github.com/CoreWCF/CoreWCF/commit/f2f1a05927a88b8a75fa0582fa8ed75eb891e463 https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1 https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1 https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-wjpq-6766-7f5j