PT-2026-34517 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-35381

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A logic error in the cut utility occurs when the -s (only-delimited) flag is used in conjunction with the -z (null-terminated) and -d '' (empty delimiter) options. The utility incorrectly processes this combination through a specialized newline-delimiter code path that fails to verify the record suppression status. As a result, the utility emits the entire record along with a NUL byte instead of suppressing it, which differs from GNU coreutils behavior and may lead to data integrity risks in automated pipelines designed to filter undelimited data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-684

Related Identifiers

CVE-2026-35381

Affected Products

Uutils Coreutils

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-35381 · Security Note
• https://github.com/uutils/coreutils/releases/tag/0.8.0 · Vendor Advisory
• https://github.com/uutils/coreutils/pull/11394 · Patch
• https://twitter.com/CVEnew/status/2047012071230128244 · Twitter Post