Uutils coreutils 125 env Utility denial of service

Summaryinfo

A vulnerability identified as problematic has been detected in Uutils coreutils 125. Affected by this issue is some unknown functionality of the component env Utility. The manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2026-35377. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in Uutils coreutils 125 and classified as problematic. This issue affects some unknown functionality of the component env Utility. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In GNU env, backslashes within single quotes are treated literally (with the exceptions of \\ and \'). However, the uutils implementation incorrectly attempts to validate these sequences, resulting in an "invalid sequence" error and an immediate process termination with an exit status of 125 when encountering valid but unrecognized sequences like \a or \x. This divergence from GNU behavior breaks compatibility for automated scripts and administrative workflows that rely on standard split-string semantics, leading to a local denial of service for those operations.

The weakness was disclosed by Zellic. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-35377 since 04/02/2026. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-25030). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Uutils

Name

• coreutils

Version

• 125

Website

• Product: https://github.com/uutils/coreutils/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion