https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:21:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292581 EUVD-2026-292581 https://cve.radiocsirt.org/vuln/euvd-2026-292581 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35381 <p>A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d &#39;&#39; (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.</p> <p>A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d &#39;&#39; (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35381 https://cve.radiocsirt.org/vuln/ghsa-pmfc-4wjj-gmhx <p><strong>Affected:</strong> crates.io: uu_cut</p> <p>`cut` routes `-z -d &#39;&#39;` through a special newline-delimiter path that ignores the `-s` only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on `cut -s` to drop undelimited records process data that should be filtered. ``` printf &#39;abc&#39; | cut -z -d &#39;&#39; -s -f 1 | od -An -tx1 # GNU: no output ; uutils: 61 62 63 00 ```</p> <p>--- _Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._</p> <p><strong>Affected:</strong> crates.io: uu_cut</p> <p>`cut` routes `-z -d &#39;&#39;` through a special newline-delimiter path that ignores the `-s` only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on `cut -s` to drop undelimited records process data that should be filtered. ``` printf &#39;abc&#39; | cut -z -d &#39;&#39; -s -f 1 | od -An -tx1 # GNU: no output ; uutils: 61 62 63 00 ```</p> <p>--- _Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._</p> https://cve.radiocsirt.org/vuln/ghsa-pmfc-4wjj-gmhx https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-35381 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-coreutils, Ubuntu:25.10: rust-coreutils</p> <p>A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d &#39;&#39; (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-coreutils, Ubuntu:25.10: rust-coreutils</p> <p>A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d &#39;&#39; (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-35381