Executive brief
A logic error in the 'ln' utility of uutils coreutils causes it to fail when processing files with names that do not follow standard UTF-8 encoding. This tool is a Rust-based alternative to the standard GNU core utilities used for basic file operations. In practice, this means automated scripts or system tasks may fail to create links for certain files, potentially causing operational disruptions or a local denial of service for specific file management tasks.
Technical details
A logic error in the 'ln' utility of uutils coreutils (a Rust implementation of GNU coreutils) causes the program to enforce UTF-8 encoding on source paths when using target-directory forms (e.g., 'ln SOURCE... DIRECTORY'). Unlike GNU ln, which treats filenames as raw bytes, the uutils implementation fails to 'stat' files containing non-UTF-8 bytes, resulting in a non-zero exit code and failure to create the link. This vulnerability is classified as CWE-176 (Improper Handling of Unicode Encoding). An attacker or a system environment with such filenames can cause local denial of service for automated scripts or administrative tasks that rely on the utility. The issue was addressed in pull request #11403.
Affected products
- uutils coreutils <= 0.8.0
Timeline
- 2026-03-18: disclosed: Issue reported via pull request #11403
- 2026-04-22: advisory: Initial GHSA and NVD publication
- 2026-06-06: patched: Fix merged into uutils coreutils main branch
- 2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-jcjr-rh8q-7xqf