Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. coreutils
  4. ›
  5. CVE-2026-35369

CVE-2026-35369: uutils coreutils has an Improper Input Validation issue

April 22, 2026 (updated April 30, 2026)

An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument.

References

  • github.com/advisories/GHSA-gpcg-h6x2-c26p
  • github.com/uutils/coreutils/commit/2d3aebce6712841bc08b9b94e9078be50a25fc10
  • github.com/uutils/coreutils/pull/9700
  • github.com/uutils/coreutils/releases/tag/0.6.0
  • nvd.nist.gov/vuln/detail/CVE-2026-35369

Code Behaviors & Features

Detect and mitigate CVE-2026-35369 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 0.6.0

Fixed versions

  • 0.6.0

Solution

Upgrade to version 0.6.0 or above.

Impact 5.5 MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-20: Improper Input Validation

Source file

cargo/coreutils/CVE-2026-35369.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:11 +0000.