CVE-2026-56289 Loop with Unreachable Exit Condition in GNU patch

What is CVE-2026-56289?

CVE-2026-56289 is a medium-severity denial of service vulnerability in GNU patch, published on 9 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination.

This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9

Weakness: CWE-835

Which versions are affected by CVE-2026-56289?

It affects 1 product.

Products include Gnu Patch.

How do I fix CVE-2026-56289?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-56289 being exploited?

There is no known exploitation of CVE-2026-56289 in the wild and no public exploit code.

Other vulnerabilities in GNU patch

• CVE-2018-20969 Command injection in n/a High 7.8
• CVE-2018-6952 Use after free in n/a High 7.5
• CVE-2019-13636 Path traversal in n/a Medium 5.9
• CVE-2021-45261 Null dereference in n/a Medium 5.5
• CVE-2019-20633 Use after free in n/a Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-92151, DEBIAN-CVE-2026-56289, ECHO-6808-09a0-f94e, GHSA-3m3r-f94v-4mf8, JLSEC-2026-1261, RHSA-2026:37468 and 1 more.