CVE-2026-35358 uutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream Reading
The cp utility in uutils coreutils causes denial of service by reading device nodes as streams during recursive copies, leading to disk exhaustion or hangs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35358?
CVE-2026-35358 is a medium-severity denial of service vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.
Weakness: CWE-706
Which versions are affected by CVE-2026-35358?
2 open source packages ship an affected version, including uu_cp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
uu_cp crates.io | All versions | 0.7.0 |
uu_cp crates.io | All versions | 0.7.0 |
Products include Uutils Coreutils.
How do I fix CVE-2026-35358?
Upgrade uu_cp to 0.7.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-35358 being exploited?
There is no known exploitation of CVE-2026-35358 in the wild and no public exploit code.
Other vulnerabilities in Uutils coreutils
- CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root
- CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
- CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
- CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
- CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root
Sources
Also known as DEBIAN-CVE-2026-35358, GHSA-8vrf-r662-2w2v, UBUNTU-CVE-2026-35358.