CVE-2026-35381: uutils coreutils cut Local Logic Error and Data Integrity Issue in Output Filtering

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-22 · updated 2026-10-26
Weakness: CWE-684

Description

A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.

Affected products

Uutils coreutils: before 0.8.0 — fixed in 0.8.0

How to fix

Upgrade to a fixed version: Uutils coreutils 0.8.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-35381 or the next vulnerability affects your stack