CVEPublished 2026-04-22Modified 2026-05-040 articles on news6 live referencesNVD data

CVE-2026-35373Uutils · Coreutils

Vulnerability data via NVD (ingested)

CVSS v3.1
3.3
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS percentile
3
Exploit Prediction Scoring System · top 97% of all CVEs
Description

A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.

Timeline
Published 2026-04-22
Modified 2026-05-04

External references

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

More intel sources (5)

Known PoCs on GitHub

No public proof-of-concept repositories found for CVE-2026-35373 on GitHub.
We haven't classified any articles referencing CVE-2026-35373 yet. The external references above still apply.