{"id":"EUVD-2026-24979","enisaUuid":"4d343500-53e6-33a8-973b-c60f28461b92","description":"The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.","datePublished":"Apr 22, 2026, 4:07:54 PM","dateUpdated":"Apr 22, 2026, 6:11:31 PM","baseScore":4.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/uutils/coreutils/pull/9545\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","aliases":"CVE-2026-35347\nGHSA-3wfc-mgpm-9rq6\n","assigner":"canonical","epss":0.14,"enisaIdProduct":[{"id":"db67b85a-9098-3038-ac56-39d515628a24","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"enisaIdVendor":[{"id":"4cbd77de-7b73-3c08-aee9-c0c33d383f23","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"26d49d28-89e1-3f15-b136-13cc3886ca33","vulnerability":{"id":"CVE-2026-35347","description":"The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.","datePublished":"Apr 22, 2026, 4:07:54 PM","dateUpdated":"Apr 22, 2026, 6:11:31 PM","status":"PUBLISHED","baseScore":4.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/uutils/coreutils/pull/9545\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24979\n","assigner":"canonical","epss":0.14,"dataProcessed":"Oct 30, 2026, 7:18:58 AM","vulnerabilityProduct":[{"id":"9065aa7d-440b-3405-97db-946a3cf417ae","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"vulnerabilityVendor":[{"id":"462ec8e7-9637-33e4-818d-83c3c0568b21","vendor":{"name":"Uutils"}}]}},{"id":"4c0bc42f-c95e-37dc-89c6-f1ddced9cdae","vulnerability":{"id":"GHSA-3wfc-mgpm-9rq6","description":"comm: FIFO/pipe inputs are drained before comparison (data loss / hang)","datePublished":"Jul 6, 2026, 8:17:59 PM","dateUpdated":"Jul 6, 2026, 8:17:59 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-3wfc-mgpm-9rq6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35347\nhttps://github.com/uutils/coreutils/pull/9545\nhttps://github.com/uutils/coreutils/commit/75f45e87e52ed95840494963ab9a28651165d56e\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24979\n","aliases":"CVE-2026-35347\nGHSA-3wfc-mgpm-9rq6\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c88cc3ff-edca-3907-9529-80bc231b9d44","vulnerability":{"id":"GHSA-rx8h-33gr-vhj9","description":"Duplicate Advisory: uutils coreutils\u0027 comm utility incorrectly consumes data from non-regular file inputs before performing comparison operations","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Jul 6, 2026, 8:17:50 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35347\nhttps://github.com/uutils/coreutils/pull/9545\nhttps://github.com/uutils/coreutils/commit/75f45e87e52ed95840494963ab9a28651165d56e\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24979\n","aliases":"GHSA-rx8h-33gr-vhj9\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}