Skip to main content

GNU patch CVE-2026-56289

| EUVDEUVD-2026-42557 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-07-09 CERT-PL GHSA-3m3r-f94v-4mf8
Denial Of Service Red Hat Patch Suse Gnu
4.6
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
4.6 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local vector (AV:L) and required user interaction (UI:R) because victim must actively run patch against a malicious file; only availability impacted (A:L), no confidentiality or integrity loss.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
SUSE
3.3 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 09, 2026 - 12:08 vuln.today

DescriptionCVE.org

GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination.

This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9

AnalysisAI

GNU patch enters an infinite CPU-consuming loop when processing a specially crafted unified-diff file containing an excessively large hunk line offset, resulting in a denial of service. The utility becomes unresponsive and must be manually terminated, impacting any pipeline, CI/CD system, or developer workflow that applies untrusted patch files. No public exploit has been identified at time of analysis, and an upstream fix commit has been published by the maintainers on Savannah; a formally tagged release is not yet independently confirmed.

Technical ContextAI

GNU patch (CPE: cpe:2.3:a:gnu:patch:*:*:*:*:*:*:*:*) is the canonical Unix utility for applying unified diff files to source trees. The vulnerable code path processes hunk headers in unified-diff format, which specify a starting line number and length for each change block. CWE-835 (Loop with Unreachable Exit Condition) describes the root cause: when an attacker supplies an astronomically large line offset value, the parser enters a seek loop attempting to advance to the requested position, consuming 100% of a CPU core indefinitely. Because GNU patch reads and applies diffs sequentially and blocks on this loop, the process never advances to completion. The flaw affects all versions covered by the CPE wildcard (all current GNU patch releases) as no specific floor version is excluded in the advisory data.

RemediationAI

Apply the upstream fix commit faba04ef4f2b410257f76c1b9dc85e350929c4b9 from the GNU patch Savannah repository (cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9). A formally tagged and released patched version has not been independently confirmed from the available data - monitor the upstream repository and downstream distribution security channels for an official release. As a compensating control for automated pipelines, wrap patch invocations with a CPU time limit (e.g., ulimit -t 30 on Linux, or timeout 30 patch ... ) to prevent runaway processes from blocking builds; this carries the trade-off of potentially aborting legitimate large patch operations. For systems consuming untrusted patch files, consider validating or sanitizing hunk line offsets before passing input to GNU patch, or restrict the sources from which patch files are accepted to trusted, integrity-verified origins.

More in Patch

View all
CVE-2021-45261 MEDIUM POC
5.5 Dec 22

An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service
CVE-2015-1196 MEDIUM POC
4.3 Jan 21

GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file. Rated medium s
CVE-2015-1395 HIGH
7.5 Aug 25

Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote atta
CVE-2019-13638 HIGH
7.8 Jul 26

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch fil
CVE-2018-1000156 HIGH
7.8 Apr 06

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_
CVE-2018-6952 HIGH
7.5 Feb 13

A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), t
CVE-2018-6951 HIGH
7.5 Feb 13

An issue was discovered in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2025-15337 MEDIUM
6.5 Feb 05

Tanium addressed an incorrect default permissions vulnerability in Patch. [CVSS 6.5 MEDIUM]
CVE-2026-11391 MEDIUM
6.3 Jul 28

SQL injection in Tanium Patch allows authenticated low-privilege attackers to read, modify, or delete data from the back
CVE-2019-13636 MEDIUM
5.9 Jul 17

In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. Rated mediu
CVE-2014-9637 MEDIUM
5.5 Aug 25

GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fa
CVE-2026-56288 MEDIUM
4.6 Jul 09

GNU patch crashes with a NULL pointer dereference when a user applies a specially crafted unified-diff file, resulting i

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container bci/bci-sle15-kernel-module-devel:latest Container bci/spack:latest Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
SUSE Linux Micro 6.2 Fixed

Share

CVE-2026-56289 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy