Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-35343 EUVD-2026-24973GHSA-hj9r-8pfm-rmjjGHSA-wv33-5pxh-r7j7

uutils coreutils cut Inconsistent Output Suppression with Newline Delimiters

Published Apr 22, 2026 · Updated Apr 22, 2026 · Assigned by canonical

Description

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Affected products

VendorProductAffectedFixed
Uutils coreutils < 0.8.0 0.8.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-coreutils 0.7.0-1 —
Debian 13 rust-coreutils No fix yet —
Debian 12 rust-coreutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 rust-coreutils No fix yet —
Ubuntu 24.04 LTS rust-coreutils No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io uu_cut < 0.7.0 0.7.0 GHSA-wv33-5pxh-r7j7

References