CVE-2026-35343: uutils coreutils cut Inconsistent Output Suppression with Newline Delimiters
The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the onlydelimited flag in the cutfieldsnewlinechardelim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_cutto a version that resolves this vulnerability.Fixed in 0.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35343?
CVE-2026-35343 is classified as a moderate severity vulnerability due to its impact on output handling.
How do I fix CVE-2026-35343?
To fix CVE-2026-35343, update to the latest version of uutils coreutils that addresses this issue.
What specific issue does CVE-2026-35343 cause in uutils coreutils?
CVE-2026-35343 causes inconsistent output when using the -s option with a newline delimiter in the cut utility.
Which version of uutils coreutils is affected by CVE-2026-35343?
CVE-2026-35343 affects specific versions of uutils coreutils prior to the fix included in the latest release.
Is CVE-2026-35343 applicable to other utilities apart from cut?
CVE-2026-35343 specifically pertains to the cut utility within uutils coreutils and does not affect other utilities.