{"id":"EUVD-2026-24973","enisaUuid":"94e05a98-ee3b-3a99-88a6-c1f388540f26","description":"The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.","datePublished":"Apr 22, 2026, 4:07:44 PM","dateUpdated":"Apr 22, 2026, 6:05:43 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/uutils/coreutils/pull/11143\nhttps://github.com/uutils/coreutils/releases/tag/0.7.0\n","aliases":"CVE-2026-35343\nGHSA-wv33-5pxh-r7j7\n","assigner":"canonical","epss":0.14,"enisaIdProduct":[{"id":"79fee339-b151-37a9-a1db-cc422820af6d","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.8.0"}],"enisaIdVendor":[{"id":"57f34764-0b03-3028-b88b-c2a0cf733c6e","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"5db5176d-b6e7-309d-b336-f92b56c52ae4","vulnerability":{"id":"CVE-2026-35343","description":"The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.","datePublished":"Apr 22, 2026, 4:07:44 PM","dateUpdated":"Apr 22, 2026, 6:05:43 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/uutils/coreutils/pull/11143\nhttps://github.com/uutils/coreutils/releases/tag/0.7.0\n","enisa_id":"EUVD-2026-24973\n","assigner":"canonical","epss":0.14,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"08ca9582-98b2-3a63-a8d6-17a9d8bf9820","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.8.0"}],"vulnerabilityVendor":[{"id":"26ca7998-e5b9-3953-b88a-455f627591dc","vendor":{"name":"Uutils"}}]}},{"id":"75e49cd5-b01d-32b3-be98-ff3007e02a15","vulnerability":{"id":"GHSA-wv33-5pxh-r7j7","description":"cut: -s (only-delimited) ignored when delimiter is a newline","datePublished":"Jul 6, 2026, 7:54:33 PM","dateUpdated":"Jul 6, 2026, 7:54:33 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-wv33-5pxh-r7j7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35343\nhttps://github.com/uutils/coreutils/pull/11143\nhttps://github.com/uutils/coreutils/commit/9bbb58b746c41802278b0cba738eebbf21517cf7\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.7.0\n","enisa_id":"EUVD-2026-24973\n","aliases":"GHSA-wv33-5pxh-r7j7\nCVE-2026-35343\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b2cd57a1-3f06-11f1-8640-7ced8d12c988","vulnerability":{"id":"GHSA-hj9r-8pfm-rmjj","description":"Duplicate Advisory: uutils coreutils has an Issue With its Always-Incorrect Control Flow Implementation","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Jul 6, 2026, 7:54:28 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35343\nhttps://github.com/uutils/coreutils/pull/11143\nhttps://github.com/uutils/coreutils/commit/9bbb58b746c41802278b0cba738eebbf21517cf7\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.7.0\n","enisa_id":"EUVD-2026-24973\n","aliases":"GHSA-hj9r-8pfm-rmjj\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}