CVE-2026-35343

Description

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

PUBLISHED Reserved 2026-04-02 | Published 2026-04-22 | Updated 2026-04-22 | Assigner canonical

Problem types

CWE-670: Always-Incorrect Control Flow Implementation

Product status

Credits

Zellic finder

References

github.com/uutils/coreutils/pull/11143 patch issue-tracking

github.com/uutils/coreutils/releases/tag/0.7.0 vendor-advisory

cve.org (CVE-2026-35343)

nvd.nist.gov (CVE-2026-35343)

Download JSON