Most recent entries from all

ALSA-2026:67886 — Moderate: coreutils security update

Affected: AlmaLinux:10: coreutils, AlmaLinux:10: coreutils-common, AlmaLinux:10: coreutils-single

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.

Security Fix(es):

* coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input (CVE-2026-56391) * coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

EUVD-2026-340513

fkie_cve-2026-56391

When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.

This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

GHSA-7xvj-m9x7-qgxq

When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.

This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

msrc_CVE-2026-56391 — Out‑of‑bounds Read in GNU coreutils

msrc_CVE-2026-56391

openSUSE-SU-2026:11764-1 — coreutils-9.11-5.1 on GA media

coreutils-9.11-5.1 on GA media

RHSA-2026:46515 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input

RLSA-2026:67886 — Moderate: coreutils security update

Affected: Rocky Linux:10: coreutils

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.

Security Fix(es):

* coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input (CVE-2026-56391)

* coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-56391

Affected: Ubuntu:26.04:LTS: coreutils

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure. This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.