CVE-2026-56289: Loop with Unreachable Exit Condition in GNU patch
GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination.
This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9
Other sources
Loop with Unreachable Exit Condition in GNU patch
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.6-10 - Upgrade
Upgrade
GNU patchto a version that resolves this vulnerability.Fixed in faba04ef4f2b410257f76c1b9dc85e350929c4b9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56289?
CVE-2026-56289 has a medium severity rating of 4.6 according to the CVSS score.
How does CVE-2026-56289 affect GNU patch?
CVE-2026-56289 causes a denial of service (DoS) due to an infinite processing loop triggered by a specially crafted patch.
What versions of GNU patch are impacted by CVE-2026-56289?
CVE-2026-56289 affects multiple versions of GNU patch released before the remediation.
How can I mitigate CVE-2026-56289 in my environment?
Mitigating CVE-2026-56289 can typically be achieved by upgrading to the latest version of GNU patch that addresses the vulnerability.
Is there any indication of public exploitation for CVE-2026-56289?
As of its publication date, there are no known instances of public exploitation for CVE-2026-56289.