PT-2026-34515 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-35379

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A logic error in the tr utility causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, reversing the standard behavior established by POSIX and GNU coreutils. This can lead to unintended data modification or loss in automated scripts or data-cleaning pipelines that rely on standard character class semantics, such as incorrectly deleting ASCII spaces when intending to preserve whitespace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-684

Related Identifiers

CVE-2026-35379

Affected Products

Uutils Coreutils

References · 4

• https://github.com/uutils/coreutils/pull/11405 · Patch
• https://github.com/uutils/coreutils/releases/tag/0.8.0 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35379 · Security Note
• https://twitter.com/CVEnew/status/2047012073885028800 · Twitter Post