CVE-2026-35381: 
Rust vulnerability analysis and mitigation

CVE-2026-35381 is a logic error (Incorrect Provision of Specified Functionality) in the cut utility of uutils coreutils, a Rust-based reimplementation of GNU coreutils. The flaw causes the -s (only-delimited) flag to be silently ignored when combined with -z (null-terminated) and -d '' (empty delimiter) options, resulting in undelimited records being emitted instead of suppressed. All versions of uutils coreutils prior to 0.8.0 for Rust are affected. The vulnerability was disclosed on April 22, 2026, and carries a CVSS v3.1 base score of 3.3 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-684 (Incorrect Provision of Specified Functionality). When cut is invoked with -z -d '' -s, the implementation incorrectly routes this specific flag combination through a specialized newline-delimiter code path that does not check the record suppression (-s) status. As a result, instead of suppressing records that contain no delimiter (as GNU coreutils does), uutils cut emits the entire record followed by a NUL byte. The attack vector is local, requiring low privileges and no user interaction. A concrete reproduction command is: printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1 — GNU coreutils produces no output, while uutils emits 61 62 63 00 (GitHub PR #11394, Github Advisory).

The primary impact is a data integrity issue affecting automated pipelines that rely on cut -s to filter out undelimited records. A local user with standard execution privileges can trigger incorrect output that includes records which should have been suppressed, potentially causing downstream pipeline stages to process unexpected or malformed data. There is no confidentiality or availability impact; the scope is unchanged and limited to integrity (Low) (Github Advisory, Red Hat Bugzilla).

A proof-of-concept reproduction command is publicly available in the GitHub pull request that fixed the issue, demonstrating the bug with a simple shell one-liner. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term (GitHub PR #11394, Github Advisory).

1. Identify affected environment: Confirm the target system uses uutils coreutils (Rust) version prior to 0.8.0 as the cut utility, rather than GNU coreutils.
2. Craft the triggering input: Prepare input data that contains no delimiter — for example, the string abc with no empty-string delimiter present.
3. Invoke the vulnerable flag combination: Run printf 'abc' | cut -z -d '' -s -f 1 — the -z flag enables null-terminated mode, -d '' sets an empty delimiter, and -s is intended to suppress undelimited records.
4. Observe incorrect output: Instead of producing no output (as GNU coreutils would), uutils cut emits the full record plus a NUL byte (61 62 63 00 in hex), which can be verified with | od -An -tx1.
5. Exploit pipeline context: In an automated pipeline that relies on cut -s to filter undelimited data before passing output to a downstream process, the attacker (or a malicious input source) can cause unintended records to flow through the pipeline, potentially corrupting data processing logic (GitHub PR #11394).

Upgrade uutils coreutils to version 0.8.0 or later, which includes the fix merged on March 20, 2026 (commit 483f13e) (GitHub Release 0.8.0, GitHub PR #11394). If immediate patching is not possible, audit and refactor any automated scripts or pipelines that use cut with the -s, -z, and -d '' flags in combination, replacing this functionality with an alternative implementation (e.g., using GNU coreutils cut, awk, or perl) that correctly handles record suppression. Test any workarounds thoroughly in a staging environment before deploying to production (Github Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2460810) and assigned it a low severity rating, reflecting the limited scope of the vulnerability (Red Hat Bugzilla). The uutils project maintainers merged the fix promptly (within two days of the report) and included it in the 0.8.0 release, which also noted continued upstream collaboration with GNU coreutils — the fix led to a corresponding test being added to the GNU coreutils test suite (GitHub Release 0.8.0). An Ubuntu community discussion thread on Rust coreutils adoption was also noted in relation to this disclosure (Ubuntu Discourse).