{"id":"EUVD-2026-25038","enisaUuid":"ae612d66-dd6e-3c56-b4a4-9f6ecd9c69ad","description":"A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d \u0027\u0027 (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.","datePublished":"Apr 22, 2026, 4:09:22 PM","dateUpdated":"Apr 22, 2026, 4:53:09 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/uutils/coreutils/pull/11394\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","aliases":"CVE-2026-35381\nGHSA-pmfc-4wjj-gmhx\n","assigner":"canonical","epss":0.18,"enisaIdProduct":[{"id":"c658ea6d-5335-3c83-a21a-b7e2b3c13220","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.8.0"}],"enisaIdVendor":[{"id":"2eb0f560-fa95-300c-847a-e21acb3df15d","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"28d4e197-e6aa-349d-b358-c44a463e246c","vulnerability":{"id":"CVE-2026-35381","description":"A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d \u0027\u0027 (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.","datePublished":"Apr 22, 2026, 4:09:22 PM","dateUpdated":"Apr 22, 2026, 4:53:09 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/uutils/coreutils/pull/11394\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","enisa_id":"EUVD-2026-25038\n","assigner":"canonical","epss":0.18,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"f33641bc-2af9-3f8a-99f7-f57912da00b6","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.8.0"}],"vulnerabilityVendor":[{"id":"c1267e25-9fe1-3667-b8e5-da88048b7c81","vendor":{"name":"Uutils"}}]}},{"id":"28e5589f-edd7-3cef-9009-9b6b917ebae4","vulnerability":{"id":"GHSA-532v-xp3f-837c","description":"Duplicate Advisory: uutils coreutils has an Incorrect Provision of Specified Functionality Issue in its cut Utility","datePublished":"Apr 22, 2026, 6:31:46 PM","dateUpdated":"Jul 6, 2026, 9:54:21 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35381\nhttps://github.com/uutils/coreutils/pull/11394\nhttps://github.com/uutils/coreutils/commit/483f13e91830c468262aa1e010e753d6ae99c898\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","enisa_id":"EUVD-2026-25038\n","aliases":"GHSA-532v-xp3f-837c\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"969af767-8132-3706-b8ca-0fd2d5673bf0","vulnerability":{"id":"GHSA-pmfc-4wjj-gmhx","description":"cut: -s ignored in -z -d \u0027\u0027 newline-delimiter mode","datePublished":"Jul 6, 2026, 9:54:29 PM","dateUpdated":"Oct 6, 2026, 6:15:53 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-pmfc-4wjj-gmhx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35381\nhttps://github.com/uutils/coreutils/pull/11394\nhttps://github.com/uutils/coreutils/commit/483f13e91830c468262aa1e010e753d6ae99c898\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","enisa_id":"EUVD-2026-25038\n","aliases":"CVE-2026-35381\nGHSA-pmfc-4wjj-gmhx\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}