Logic Error in uutils Coreutils Affects Command-Line Parsing

CVE-2026-35377

What is CVE-2026-35377?

A logic error in the uutils coreutils' env utility disrupts the parsing of command-line arguments when using the -S (split-string) option. Specifically, it mishandles backslashes in single quotes, leading to unintended 'invalid sequence' errors when encountering valid escape sequences. This behavior diverges from the expected GNU env implementation, resulting in process termination and creating compatibility issues for automated scripts and administrative tasks. Consequently, users may experience local denial of service due to the interruption of standard operations reliant on correct string splitting.

References