PT-2026-34517 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-35381

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A logic error in the cut utility occurs when the -s (only-delimited) flag is used in conjunction with the -z (null-terminated) and -d '' (empty delimiter) options. The utility incorrectly processes this combination through a specialized newline-delimiter code path that fails to verify the record suppression status. As a result, the utility emits the entire record along with a NUL byte instead of suppressing it, which differs from GNU coreutils behavior and may lead to data integrity risks in automated pipelines designed to filter undelimited data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-684

Related Identifiers

CVE-2026-35381

GHSA-532V-XP3F-837C

Affected Products

Uutils Coreutils

References · 12

• https://github.com/uutils/coreutils/pull/11394 · Patch
• https://github.com/uutils/coreutils/releases/tag/0.8.0 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-532v-xp3f-837c · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35381 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35381 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35381 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35381 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35381 · Security Note
• https://github.com/uutils/coreutils/commit/483f13e91830c468262aa1e010e753d6ae99c898 · Note
• https://github.com/uutils/coreutils · Note
• https://twitter.com/CVEnew/status/2047012071230128244 · Twitter Post