CVE-2026-56289: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') in GNU patch
GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination. This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9
AI Analysis
Technical Summary
CVE-2026-56289 describes a denial of service vulnerability in GNU patch where improper validation of hunk line offsets in unified-diff input can cause an effectively infinite processing loop. When processing a specially crafted patch file with an extremely large line number, the application enters a loop attempting to locate the requested position, leading to excessive CPU usage and process hang. The vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition). The issue has been addressed and fixed in commit faba04ef4f2b410257f76c1b9dc85e350929c4b9.
Potential Impact
An attacker can cause GNU patch to become unresponsive by supplying a malicious patch file, resulting in denial of service through excessive CPU consumption and process hang. There is no indication of privilege escalation or code execution. The impact is limited to availability disruption of the patch utility.
Mitigation Recommendations
A fix is available and has been implemented in the commit identified by faba04ef4f2b410257f76c1b9dc85e350929c4b9. Users should update GNU patch to a version that includes this commit to remediate the vulnerability. Patch status is not explicitly confirmed in the advisory, so users should verify the presence of this fix in their version. No alternative mitigations are specified.
CVE-2026-56289: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') in GNU patch
Description
GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination. This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9
CVSS v4.0
Score 4.6medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56289 describes a denial of service vulnerability in GNU patch where improper validation of hunk line offsets in unified-diff input can cause an effectively infinite processing loop. When processing a specially crafted patch file with an extremely large line number, the application enters a loop attempting to locate the requested position, leading to excessive CPU usage and process hang. The vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition). The issue has been addressed and fixed in commit faba04ef4f2b410257f76c1b9dc85e350929c4b9.
Potential Impact
An attacker can cause GNU patch to become unresponsive by supplying a malicious patch file, resulting in denial of service through excessive CPU consumption and process hang. There is no indication of privilege escalation or code execution. The impact is limited to availability disruption of the patch utility.
Mitigation Recommendations
A fix is available and has been implemented in the commit identified by faba04ef4f2b410257f76c1b9dc85e350929c4b9. Users should update GNU patch to a version that includes this commit to remediate the vulnerability. Patch status is not explicitly confirmed in the advisory, so users should verify the presence of this fix in their version. No alternative mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERT-PL
- Date Reserved
- 2026-06-20T10:58:09.261Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4f797f68715ace432894f9
Added to database: 07/09/2026, 10:35:43 UTC
Last enriched: 07/09/2026, 10:48:55 UTC
Last updated: 07/10/2026, 02:38:25 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.