Moderate Vulnerability in Coreutils: Denial of Service via Crafted Tab Stop Values
Summary
ALSA-2026:66403: Moderate: coreutils security update. Affects coreutils versions < 8.32-41.el9_8.1. Fixed in 8.32-41.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Coreutils is a package that contains the GNU Core Utilities, which are essential for file manipulation, text processing, and system management tasks in Unix-like operating systems. It combines functionalities from previously separate packages like GNU fileutils, sh-utils, and textutils. The coreutils package is widely used across various distributions, including AlmaLinux, and is critical for system operations. This vulnerability affects the coreutils package version prior to 8.32-41.el9_8.1, making it susceptible to Denial of Service (DoS) attacks through specially crafted tab stop values.
Vulnerability Detail
The vulnerability identified as CVE-2026-56392 allows an attacker to exploit the unexpand command within the coreutils package. By providing crafted tab stop values, an attacker can trigger a Denial of Service condition, potentially causing the application to crash or become unresponsive. This vulnerability arises from improper handling of input values, which can lead to resource exhaustion or infinite loops, severely impacting system availability.
How To Fix
Minimum fixed version
8.32-41.el9_8.1
This is the first release that contains the fix.
sudo dnf update coreutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider restricting access to the unexpand command or implementing input validation to prevent the exploitation of crafted tab stop values. However, the best course of action remains to update the package as soon as possible.
Conclusion
The coreutils package has a moderate vulnerability (CVE-2026-56392) that can lead to Denial of Service attacks through crafted tab stop values. It is crucial to update to the latest patched version to ensure system security and availability. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert, which can provide real-time alerts without requiring extensive setup.
See every vulnerability recorded for coreutils →
FAQ
CVE-2026-56392 is a vulnerability in the coreutils package that allows for Denial of Service attacks via crafted tab stop values.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to Denial of Service, causing the application to crash or become unresponsive, which can affect system availability.
Yes, a patch is available in the form of an updated coreutils package version 8.32-41.el9_8.1 or later.
If immediate updates are not possible, consider restricting access to the unexpand command or implementing input validation as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for coreutils.
