PT-2026-34479 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-35343

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description The cut utility incorrectly handles the -s (only-delimited) option when a newline character is used as the delimiter. The cut fields newline char delim() function fails to verify the only delimited flag, which results in the utility printing non-delimited lines that should have been suppressed. This behavior may cause unexpected data to be passed to downstream scripts that depend on strict output filtering.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2026-35343

GHSA-HJ9R-8PFM-RMJJ

Affected Products

Uutils Coreutils

References · 12

• https://github.com/uutils/coreutils/pull/11143 · Patch
• https://github.com/uutils/coreutils/releases/tag/0.7.0 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35343 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35343 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-35343 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35343 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35343 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35343 · Security Note
• https://osv.dev/vulnerability/GHSA-hj9r-8pfm-rmjj · Vendor Advisory
• https://github.com/uutils/coreutils/commit/9bbb58b746c41802278b0cba738eebbf21517cf7 · Note
• https://github.com/uutils/coreutils · Note
• https://twitter.com/CVEnew/status/2047012112644653525 · Twitter Post