CVE-2026-35347 PUBLISHED

uutils coreutils comm Silent Data Loss or Denial of Service via Improper Input Validation

Assigner: canonical
Reserved: 02.04.2026 Published: 22.04.2026 Updated: 22.04.2026

The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 4.4

Product Status

Vendor Uutils
Product coreutils
Versions Default: unaffected
  • affected from 0 to 0.6.0 (excl.)

Credits

  • Zellic finder

References

Problem Types

  • CWE-20: Improper Input Validation CWE

Impacts

  • CAPEC-130: Excessive Allocation