Skip to main content

GNU patch EUVDEUVD-2026-42557

| CVE-2026-56289 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-07-09 CERT-PL GHSA-3m3r-f94v-4mf8
Denial Of Service Patch Gnu
4.6
CVSS 4.0 · Vendor: CERT-PL
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft unified diff with extreme hunk line offset
  2. Delivery
    Host or deliver malicious patch file to target
  3. Exploit
    Victim invokes GNU patch on the file
  4. Execution
    Parser enters unbounded line-seek loop
  5. Persist
    CPU pegged at 100%, process unresponsive
  6. Impact
    Pipeline or session stalls until manual termination

Vulnerability Assessment

Weakness
CWE
CWE-835
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Active user interaction is required - the victim must explicitly invoke GNU patch and supply the malicious file as input (CVSS UI:A). The attack vector is local (AV:L), meaning the malicious patch file must be accessible on the target filesystem or piped directly to the process. No privileges are required to trigger the flaw (PR:N): any unprivileged user account that can run the patch binary is sufficient. Exploitation is limited to a denial of service against the patch process itself; there is no code execution, file modification, or data exfiltration. Non-default conditions that expand risk: automated CI/CD pipelines that apply externally sourced patch files without a process timeout are more susceptible, as the hang may go undetected. No authentication to a remote service is involved.
Impact

The CVSS 4.0 score of 4.6 accurately reflects the constrained real-world impact. The vector AV:L/UI:A correctly models that exploitation requires a user to actively apply a malicious patch file - this is not remotely exploitable without user interaction, and it cannot be triggered passively. The availability impact is rated Low (VA:L/SA:L), meaning only the patch process itself hangs, not the entire host. EPSS data is absent from the provided intelligence, but the attack surface is narrow: targets must be developers, package maintainers, or automated build systems that consume untrusted patch files. The SA:L signal (subsequent system low availability) is notable for CI/CD contexts where a hung patch step can stall an entire build pipeline. KEV status is negative and no POC has been identified. Reported by CERT-PL, suggesting this was discovered through targeted research rather than observed exploitation. Overall: low urgency for interactive developer workstations; moderate urgency for automated pipelines ingesting third-party patches.
Exploit ScenarioDerived

An attacker embeds a unified diff with a hunk header specifying a line offset of INT64_MAX or a similarly extreme value and distributes it as a legitimate-looking patch file via a pull request, package repository contribution, or email. A developer or CI/CD job runs GNU patch against the file; the process immediately enters an infinite seek loop, pegs a CPU core at 100%, and the build pipeline stalls until the process is manually killed or a timeout fires. No prior access to the target system is needed beyond convincing the victim to apply the file.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 09, 2026

GNU patch enters an infinite CPU-consuming loop when processing a specially crafted unified-diff file containing an excessively large hunk line offset, resulting in a denial of service. The utility becomes unresponsive and must be manually terminated, impacting any pipeline, CI/CD system, or developer workflow that applies untrusted patch files. No public exploit has been identified at time of analysis, and an upstream fix commit has been published by the maintainers on Savannah; a formally tagged release is not yet independently confirmed.

RemediationAI

Apply the upstream fix commit faba04ef4f2b410257f76c1b9dc85e350929c4b9 from the GNU patch Savannah repository (cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9). A formally tagged and released patched version has not been independently confirmed from the available data - monitor the upstream repository and downstream distribution security channels for an official release. As a compensating control for automated pipelines, wrap patch invocations with a CPU time limit (e.g., ulimit -t 30 on Linux, or timeout 30 patch ... ) to prevent runaway processes from blocking builds; this carries the trade-off of potentially aborting legitimate large patch operations. For systems consuming untrusted patch files, consider validating or sanitizing hunk line offsets before passing input to GNU patch, or restrict the sources from which patch files are accepted to trusted, integrity-verified origins.

Affected VersionsENISA

Patch 0 ≤2.8.0

Affected Packages

euvd patch no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GNU patch (CPE: cpe:2.3:a:gnu:patch:*:*:*:*:*:*:*:*) is the canonical Unix utility for applying unified diff files to source trees. The vulnerable code path processes hunk headers in unified-diff format, which specify a starting line number and length for each change block. CWE-835 (Loop with Unreachable Exit Condition) describes the root cause: when an attacker supplies an astronomically large line offset value, the parser enters a seek loop attempting to advance to the requested position, consuming 100% of a CPU core indefinitely. Because GNU patch reads and applies diffs sequentially and blocks on this loop, the process never advances to completion. The flaw affects all versions covered by the CPE wildcard (all current GNU patch releases) as no specific floor version is excluded in the advisory data.

Know when Patch gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CERT-PL) PRIMARY 4.6 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
vuln.today AI 3.3 LOW

Local vector (AV:L) and required user interaction (UI:R) because victim must actively run patch against a malicious file; only availability impacted (A:L), no confidentiality or integrity loss.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
SUSE 3.3 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Red Hat 5.5 MEDIUM

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Active
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
Low

DescriptionCVE.org

GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination.

This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
High
core Unix diff-application utility in virtually all Linux distros
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

23
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +23
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Patch

View all
CVE-2021-45261 MEDIUM POC
5.5 Dec 22

An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service
CVE-2015-1196 MEDIUM POC
4.3 Jan 21

GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file. Rated medium s
CVE-2015-1395 HIGH
7.5 Aug 25

Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote atta
CVE-2019-13638 HIGH
7.8 Jul 26

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch fil
CVE-2018-1000156 HIGH
7.8 Apr 06

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_
CVE-2018-6952 HIGH
7.5 Feb 13

A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), t
CVE-2018-6951 HIGH
7.5 Feb 13

An issue was discovered in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2025-15337 MEDIUM
6.5 Feb 05

Tanium addressed an incorrect default permissions vulnerability in Patch. [CVSS 6.5 MEDIUM]
CVE-2026-108308 MEDIUM
6.5 Oct 27

An authenticated SQL injection (CWE-89) in the Tanium Patch module lets a low-privilege user with valid console credenti
CVE-2026-11391 MEDIUM
6.3 Jul 28

SQL injection in Tanium Patch allows authenticated low-privilege attackers to read, modify, or delete data from the back
CVE-2019-13636 MEDIUM
5.9 Jul 17

In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. Rated mediu
CVE-2014-9637 MEDIUM
5.5 Aug 25

GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fa

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container bci/bci-sle15-kernel-module-devel:latest Container bci/spack:latest Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
SUSE Linux Micro 6.2 Fixed

References

Advisories & patches
PATCH https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9 ADVISORY https://access.redhat.com/errata/RHSA-2026:37468 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-56289 ADVISORY https://vuldb.com/vuln/377175 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22604/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22651/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2922/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3161/ REF https://cert.pl/en/posts/2026/07/CVE-2026-56288 REF https://cgit.git.savannah.gnu.org/cgit/patch.git/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy