CVE-2026-35343 Details
Description
The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.
A vulnerability exists in the cut utility of uutils coreutils version 0.7.0. The issue arises with the -s (only-delimited) option when a newline character is used as the delimiter. The function cut_fields_newline_char_delim fails to properly check the only_delimited flag, allowing non-delimited lines to be printed instead of suppressed. This oversight can result in unintended data being sent to downstream scripts that depend on precise output filtering.
Users can update to uutils coreutils version 0.7.0 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/pull/11143 | [email protected] | Issue TrackingPatch |
| https://github.com/uutils/coreutils/releases/tag/0.7.0 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-670 | Always-Incorrect Control Flow Implementation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | < 0.7.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | [email protected] |