Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-35378 EUVD-2026-25032GHSA-5pv5-xh52-hvrp

uutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressions

Published Apr 22, 2026 · Updated Apr 22, 2026 · Assigned by canonical

Description

A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the execution phase. This implementation flaw prevents the utility from performing proper short-circuiting for logical OR (|) and AND (&) operations. As a result, arithmetic errors (such as division by zero) occurring within "dead" branches, branches that should be ignored due to short-circuiting, are raised as fatal errors. This divergence from GNU expr behavior can cause guarded expressions within shell scripts to fail with hard errors instead of returning expected boolean results, leading to premature script termination and breaking GNU-compatible shell control flow.

Affected products

VendorProductAffectedFixed
Uutils coreutils < 0.8.0 0.8.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-coreutils 0.8.0-1 —
Debian 13 rust-coreutils No fix yet —
Debian 12 rust-coreutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 rust-coreutils No fix yet —
Ubuntu 24.04 LTS rust-coreutils No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io coreutils < 0.8.0 0.8.0 GHSA-5pv5-xh52-hvrp

References