[Pkg-rust-maintainers] Bug#1136201: rust-coreutils: CVE-2026-35373

[Moritz Mühlenhoff]

Source: rust-coreutils
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for rust-coreutils.

CVE-2026-35373[0]:
| A logic error in the ln utility of uutils coreutils causes the
| program to reject source paths containing non-UTF-8 filename bytes
| when using target-directory forms (e.g., ln SOURCE... DIRECTORY).
| While GNU ln treats filenames as raw bytes and creates the links
| correctly, the uutils implementation enforces UTF-8 encoding,
| resulting in a failure to stat the file and a non-zero exit code. In
| environments where automated scripts or system tasks process valid
| but non-UTF-8 filenames common on Unix filesystems, this divergence
| causes the utility to fail, leading to a local denial of service for
| those specific operations.

https://github.com/uutils/coreutils/pull/11403


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-35373
    https://www.cve.org/CVERecord?id=CVE-2026-35373

Please adjust the affected versions in the BTS as needed.