CVE-2026-35358

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35358
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35358.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35358
Aliases
Downstream
Published
2026-04-22T16:08:22.967Z
Modified
2026-07-08T08:12:58.493788752Z
Severity
  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
uutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream Reading
Details

The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35358.json",
    "cna_assigner": "canonical",
    "cwe_ids": [
        "CWE-706"
    ]
}
References

Affected packages

Git / github.com/uutils/coreutils

Affected ranges

Type
GIT
Repo
https://github.com/uutils/coreutils
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
995c9e04a6cc34a3a95b23a26fa59ae87e7744bd
Database specific 
{
    "cpe": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.7.0"
        }
    ]
}

Affected versions

0.*
0.0.1
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.2
0.0.20
0.0.21
0.0.22
0.0.23
0.0.24
0.0.25
0.0.26
0.0.27
0.0.28
0.0.29
0.0.3
0.0.30
0.0.30-delete
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.2.0
0.2.2
0.3.0
0.4.0
0.5.0
0.6.0
Other
latest-commit

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35358.json"