{"id":"EUVD-2026-25022","enisaUuid":"70453acb-3697-35f0-8d24-8353f0a6417f","description":"A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.","datePublished":"Apr 22, 2026, 4:09:01 PM","dateUpdated":"Apr 22, 2026, 5:20:29 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/uutils/coreutils/pull/11403\n","aliases":"CVE-2026-35373\nGHSA-jcjr-rh8q-7xqf\n","assigner":"canonical","epss":0.12,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"17b8affc-cb02-3259-8533-4bc7f79d5a98","vulnerability":{"id":"GHSA-jcjr-rh8q-7xqf","description":"ln: rejects non-UTF-8 source filenames in target-directory mode","datePublished":"Jul 6, 2026, 7:53:39 PM","dateUpdated":"Jul 6, 2026, 7:53:39 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-jcjr-rh8q-7xqf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35373\nhttps://github.com/uutils/coreutils/pull/11403\nhttps://github.com/uutils/coreutils\n","enisa_id":"EUVD-2026-25022\n","aliases":"CVE-2026-35373\nGHSA-jcjr-rh8q-7xqf\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"93dc5efd-f26a-3992-9e89-1b6e184af78e","vulnerability":{"id":"CVE-2026-35373","description":"A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.","datePublished":"Apr 22, 2026, 4:09:01 PM","dateUpdated":"Apr 22, 2026, 5:20:29 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/uutils/coreutils/pull/11403\n","enisa_id":"EUVD-2026-25022\n","assigner":"canonical","epss":0.12,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e6bb2ee1-3f0c-11f1-8640-7ced8d12c988","vulnerability":{"id":"GHSA-xh5h-p8c5-4w4x","description":"Duplicate Advisory: uutils coreutils has an Improper Handling of Unicode Encoding Issue","datePublished":"Apr 22, 2026, 6:31:46 PM","dateUpdated":"Jul 6, 2026, 7:53:31 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35373\nhttps://github.com/uutils/coreutils/pull/11403\nhttps://github.com/uutils/coreutils\n","enisa_id":"EUVD-2026-25022\n","aliases":"GHSA-xh5h-p8c5-4w4x\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}