{"id":"EUVD-2026-25017","enisaUuid":"3bede61f-7de4-3463-8601-a3987b75c5bf","description":"An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument.","datePublished":"Apr 22, 2026, 4:08:51 PM","dateUpdated":"Apr 22, 2026, 5:48:32 PM","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/uutils/coreutils/pull/9700\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","aliases":"CVE-2026-35369\nGHSA-p6rv-2qpm-fwvg\n","assigner":"canonical","epss":0.13,"enisaIdProduct":[{"id":"06fc3b32-4e52-3dc0-853b-3e87b749a43f","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"enisaIdVendor":[{"id":"465a80df-f280-3cad-ac24-db1391270585","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"246c7fe1-60ab-346c-8d82-7d291a8c7b06","vulnerability":{"id":"GHSA-gpcg-h6x2-c26p","description":"Duplicate Advisory: uutils coreutils has an Improper Input Validation issue","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Jul 6, 2026, 7:55:09 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35369\nhttps://github.com/uutils/coreutils/pull/9700\nhttps://github.com/uutils/coreutils/commit/2d3aebce6712841bc08b9b94e9078be50a25fc10\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-25017\n","aliases":"GHSA-gpcg-h6x2-c26p\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5aa84036-1863-30ba-b1fa-cabea6e1f7a1","vulnerability":{"id":"CVE-2026-35369","description":"An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument.","datePublished":"Apr 22, 2026, 4:08:51 PM","dateUpdated":"Apr 22, 2026, 5:48:32 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/uutils/coreutils/pull/9700\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-25017\n","assigner":"canonical","epss":0.13,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"a761cd67-5a2a-38eb-b72d-bc6b1fd38480","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"vulnerabilityVendor":[{"id":"dd4ff954-dc68-3776-9c00-2cd1e10742dd","vendor":{"name":"Uutils"}}]}},{"id":"f3c68a4d-5344-31e3-942a-8fe05e78e27f","vulnerability":{"id":"GHSA-p6rv-2qpm-fwvg","description":"kill: \u0027kill -1\u0027 parsed as PID -1, sending SIGTERM to all processes (system crash / DoS)","datePublished":"Jul 6, 2026, 7:55:15 PM","dateUpdated":"Jul 6, 2026, 7:55:15 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-p6rv-2qpm-fwvg\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35369\nhttps://github.com/uutils/coreutils/pull/9700\nhttps://github.com/uutils/coreutils/commit/2d3aebce6712841bc08b9b94e9078be50a25fc10\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-25017\n","aliases":"GHSA-p6rv-2qpm-fwvg\nCVE-2026-35369\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}