Login Request a demo
Medium severity · published Jul 9, 2026
CVE-2026-56289
Loop with Unreachable Exit Condition in GNU patch
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination. This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
patch · GNU
through 2.8.0 · source: vendor, NVD
Affected product
PA
patch
GNU
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56289
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56289
Third Party Advisory
https://cert.pl/en/posts/2026/07/CVE-2026-56288
Patch
https://cgit.git.savannah.gnu.org/cgit/patch.git/
Patch
https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9
More from patch
7.8
CVE-2018-20969
do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character
7.8
CVE-2019-13638
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell…
7.8
CVE-2018-1000156
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution
7.5
CVE-2015-1396
A Directory Traversal vulnerability exists in the GNU patch before 2.7.4
7.5
CVE-2018-6952
A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6