Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-35379 EUVD-2026-25034GHSA-fhr3-xh3q-69w6

uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling

Published Apr 22, 2026 · Updated Apr 22, 2026 · Assigned by canonical

Description

A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing.

Affected products

VendorProductAffectedFixed
Uutils coreutils < 0.8.0 0.8.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-coreutils 0.8.0-1 —
Debian 13 rust-coreutils No fix yet —
Debian 12 rust-coreutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 rust-coreutils No fix yet —
Ubuntu 24.04 LTS rust-coreutils No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io coreutils < 0.8.0 0.8.0 GHSA-fhr3-xh3q-69w6

References