CVE-2026-35369: CWE-20: Improper Input Validation in Uutils coreutils
A vulnerability in the kill utility of uutils coreutils causes improper input validation. The utility misinterprets the argument 'kill -1' as a request to send the default signal (SIGTERM) to PID -1, which causes the kernel to terminate all processes visible to the caller. This behavior differs from GNU coreutils, which correctly treats '-1' as a signal number and reports a missing PID argument. This can lead to a system crash or massive process termination.
AI Analysis
Technical Summary
CVE-2026-35369 is an input validation vulnerability in the kill utility of uutils coreutils. The argument parsing error causes 'kill -1' to be interpreted as sending SIGTERM to PID -1, which instructs the kernel to terminate all processes visible to the caller. This is a deviation from GNU coreutils behavior, which recognizes '-1' as a signal number and reports an error for missing PID. The vulnerability can cause significant disruption by terminating multiple processes unexpectedly.
Potential Impact
The vulnerability can lead to a denial of service condition by causing the kernel to terminate all processes visible to the user running the kill command with the '-1' argument. This can result in system instability or crash due to massive process termination. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a fix is available, avoid using 'kill -1' with uutils coreutils to prevent unintended process termination.
CVE-2026-35369: CWE-20: Improper Input Validation in Uutils coreutils
Description
A vulnerability in the kill utility of uutils coreutils causes improper input validation. The utility misinterprets the argument 'kill -1' as a request to send the default signal (SIGTERM) to PID -1, which causes the kernel to terminate all processes visible to the caller. This behavior differs from GNU coreutils, which correctly treats '-1' as a signal number and reports a missing PID argument. This can lead to a system crash or massive process termination.
CVSS v3.1
Score 5.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-35369 is an input validation vulnerability in the kill utility of uutils coreutils. The argument parsing error causes 'kill -1' to be interpreted as sending SIGTERM to PID -1, which instructs the kernel to terminate all processes visible to the caller. This is a deviation from GNU coreutils behavior, which recognizes '-1' as a signal number and reports an error for missing PID. The vulnerability can cause significant disruption by terminating multiple processes unexpectedly.
Potential Impact
The vulnerability can lead to a denial of service condition by causing the kernel to terminate all processes visible to the user running the kill command with the '-1' argument. This can result in system instability or crash due to massive process termination. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a fix is available, avoid using 'kill -1' with uutils coreutils to prevent unintended process termination.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- canonical
- Date Reserved
- 2026-04-02T12:58:56.088Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e8f7d519fe3cd2cdd00d80
Added to database: 04/22/2026, 16:31:17 UTC
Last enriched: 07/07/2026, 12:35:30 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.