Summary
The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.
Security Fix(es):
* coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input (CVE-2026-56391)
* coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | coreutils | 9.5-8.el10_2.1 |
| AlmaLinux · 10 | coreutils-common | 9.5-8.el10_2.1 |
| AlmaLinux · 10 | coreutils-single | 9.5-8.el10_2.1 |
Vulnerabilities 2
-
Medium 4.6
Out‑of‑bounds Read in GNU coreutils
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer i…
-
Low 1.8
Heap-based Buffer Overflow in GNU coreutils
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an unde…