CVE-2026-35381: uutils coreutils cut Local Logic Error and Data Integrity Issue in Output Filtering
cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered. printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1 # GNU: no output ; uutils: 61 62 63 00
--- Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
Other sources
A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_cutto a version that resolves this vulnerability.Fixed in 0.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35381?
CVE-2026-35381 is classified as a local logic error that can lead to data integrity issues.
How do I fix CVE-2026-35381?
To fix CVE-2026-35381, ensure you update uutils coreutils to the latest version that addresses this logic error.
What are the affected versions of CVE-2026-35381?
CVE-2026-35381 affects certain versions of uutils coreutils where the combination of -z and -d options can cause unexpected behavior.
What is the impact of CVE-2026-35381 on data handling?
The impact of CVE-2026-35381 is that data integrity may be compromised when the cut utility fails to apply the -s flag correctly.
Can CVE-2026-35381 be exploited in a multi-user environment?
Yes, CVE-2026-35381 can potentially be exploited in a multi-user environment where users rely on the expected functionality of the cut utility.