Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-35381 EUVD-2026-25038GHSA-532v-xp3f-837cGHSA-pmfc-4wjj-gmhx

uutils coreutils cut Local Logic Error and Data Integrity Issue in Output Filtering

Published Apr 22, 2026 · Updated Apr 22, 2026 · Assigned by canonical

Description

A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.

Affected products

VendorProductAffectedFixed
Uutils coreutils < 0.8.0 0.8.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-coreutils 0.8.0-1 —
Debian 13 rust-coreutils No fix yet —
Debian 12 rust-coreutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 rust-coreutils No fix yet —
Ubuntu 24.04 LTS rust-coreutils No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io uu_cut < 0.8.0 0.8.0 GHSA-pmfc-4wjj-gmhx

References