CVE-2026-35381 Details
Description
A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.
A logic error has been identified in the cut utility of uutils coreutils, specifically in version 0.8.0. This vulnerability arises when the -s (only-delimited) flag is used in conjunction with the -z (null-terminated) option and an empty delimiter. The utility incorrectly processes this combination by routing it through a newline-delimiter code path that fails to respect the record suppression feature. As a result, the cut utility outputs the entire record along with a NUL byte, rather than suppressing it as intended. This behavior diverges from that of GNU coreutils, creating a risk of data integrity issues in automated pipelines that depend on the cut -s option to exclude undelimited data.
Users can update to uutils coreutils version 0.8.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/pull/11394 | [email protected] | ExploitIssue TrackingPatch |
| https://github.com/uutils/coreutils/releases/tag/0.8.0 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-684 | Incorrect Provision of Specified Functionality | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | < 0.8.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | [email protected] |