uu_cp
Cross-platform Rust rewrite of the GNU coreutils
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 40
- Cadence
- ~2 months
- Last 12 months
- 9
Reach
- Downloads
- 1.1M
- Stars
- 24.0k
Details
- License
- MIT
- First release
- May 31, 2020
| Version | Released | |
|---|---|---|
0.11.0
minor
|
0.11.0
minor
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.10.0
minor
|
0.10.0
minor
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.9.0
unknown
|
0.9.0
unknown
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.8.0
unknown
|
0.8.0
unknown
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
0.7.0
unknown
|
0.7.0
unknown
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
0.6.0
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.6.0
unknown
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
0.5.0
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.5.0
unknown
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.4.0
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.4.0
unknown
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.3.0
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.3.0
unknown
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.2.2
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.2.2
unknown
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
0.2.0
unknown
yanked
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.2.0
unknown
yanked
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
0.1.0
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.1.0
unknown
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
0.0.30
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.30
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.29
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.29
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.28
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.28
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.27
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.27
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.26
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.26
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.25
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.25
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.24
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.24
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.23
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.23
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.22
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.22
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.21
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.21
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.20
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.20
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.19
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.19
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.18
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.18
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.17
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.17
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.16
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.16
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.15
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.15
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.14
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.14
unknown
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
0.0.13
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.13
unknown
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
0.0.12
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.12
unknown
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
0.0.9
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.9
unknown
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
0.0.8
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.8
unknown
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
0.0.7
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.7
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.6
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.6
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.5
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.5
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.4
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.4
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.3
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.3
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.2
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |
0.0.2
unknown
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.0.1
unknown
1 CVE
CVE-2026-35358
GHSA-8vrf-r662-2w2v
Jul 06, 2026
cp: -R reads device nodes as streams, destroying device semantics
4.4
/ 10
Medium
Local
Low
Low
None
Unchanged
None
Low
Low
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes. Zellic finding 3.53. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit Fixed in
0.7.0
References
Updated Jul 06, 2026 · Source: OSV.dev |