{"id":"GHSA-3wfc-mgpm-9rq6","revision":"d990d22f91964acead7c3bfde34cdcf7","records":[{"revision":"d990d22f91964acead7c3bfde34cdcf7","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-3wfc-mgpm-9rq6","aliases":["CVE-2026-35347"],"title":"comm: FIFO/pipe inputs are drained before comparison (data loss / hang)","description":"The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.\n\n---\n_Zellic finding 3.35. Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._","state":0,"publishedAt":"2026-07-06T20:17:59+00:00","modifiedAt":"2026-07-06T20:41:08.211382+00:00","affected":[{"ecosystem":"crates.io","name":"uu_comm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.6.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/uutils/coreutils/security/advisories/GHSA-3wfc-mgpm-9rq6","https://nvd.nist.gov/vuln/detail/CVE-2026-35347","https://github.com/uutils/coreutils/pull/9545","https://github.com/uutils/coreutils/commit/75f45e87e52ed95840494963ab9a28651165d56e","https://github.com/uutils/coreutils","https://github.com/uutils/coreutils/releases/tag/0.6.0"],"sourceUrl":"https://github.com/advisories/GHSA-3wfc-mgpm-9rq6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3wfc-mgpm-9rq6","identifiers":["GHSA-3wfc-mgpm-9rq6","CVE-2026-35347"]},"retained":false,"historicalAffected":[]}],"coverage":[]}