FYI, the following two CVEs were filed for GNU coreutils [1] [2]. These issues seem mostly harmless. You can crash the program with strange inputs, but I don't see much worse occurring. Feel free to correct me if I am missing anything.
Personally, I feel that CVEs like this provide little value, and only work to add burden to maintainers. E.g., the Debian maintainers have to push for an update to the diffutils package now for an exaggerated CVE report [3]. Additionally, at my day job customers frequently send lists of CVE scans for remediation. Often these lists include CVE-2025-5278 [4]. For customers serving data over the network, it is a bit silly that this 'sort' bug needs to be treated as a security issue. Simon McVittie seems to have had similar points on oss-security [5]. Is it worth GNU coreutils defining a more formal security policy and/or becoming a CNA to reject silly stuff like this? Just to be clear, is not to hide real security issues, which can and do occur [6]. Collin [1] https://nvd.nist.gov/vuln/detail/CVE-2026-56391 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-56392 [3] https://lists.gnu.org/archive/html/bug-diffutils/2026-07/msg00005.html [4] https://nvd.nist.gov/vuln/detail/cve-2025-5278 [5] https://www.openwall.com/lists/oss-security/2025/05/29/1 [6] https://nvd.nist.gov/vuln/detail/CVE-2015-1865
