FYI, the following two CVEs were filed for GNU coreutils [1] [2].

These issues seem mostly harmless. You can crash the program with
strange inputs, but I don't see much worse occurring. Feel free to
correct me if I am missing anything.

Personally, I feel that CVEs like this provide little value, and only
work to add burden to maintainers. E.g., the Debian maintainers have to
push for an update to the diffutils package now for an exaggerated CVE
report [3].

Additionally, at my day job customers frequently send lists of CVE scans
for remediation. Often these lists include CVE-2025-5278 [4]. For
customers serving data over the network, it is a bit silly that this
'sort' bug needs to be treated as a security issue. Simon McVittie seems
to have had similar points on oss-security [5].

Is it worth GNU coreutils defining a more formal security policy and/or
becoming a CNA to reject silly stuff like this? Just to be clear, is not
to hide real security issues, which can and do occur [6].

Collin

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-56391
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56392
[3] https://lists.gnu.org/archive/html/bug-diffutils/2026-07/msg00005.html
[4] https://nvd.nist.gov/vuln/detail/cve-2025-5278
[5] https://www.openwall.com/lists/oss-security/2025/05/29/1
[6] https://nvd.nist.gov/vuln/detail/CVE-2015-1865

Reply via email to