CVE-2026-56289: GNU patch Denial of Service Vulnerability

CVE-2026-56289 Overview

CVE-2026-56289 is a denial of service (DoS) vulnerability in GNU patch, a utility used to apply diff files to source trees. The flaw stems from improper validation of hunk line offsets in unified-diff input. A specially crafted patch file can specify an extremely large line number, forcing the utility into an effectively infinite processing loop as it attempts to locate the requested position. The resulting CPU exhaustion prevents the process from completing and requires manual termination. The issue is tracked under CWE-835: Loop with Unreachable Exit Condition and has been fixed upstream in commit faba04ef4f2b410257f76c1b9dc85e350929c4b9.

Critical Impact
A malicious unified-diff file can cause GNU patch to consume CPU indefinitely, disrupting build systems, CI/CD pipelines, and any automation that processes untrusted patch input.

Affected Products

GNU patch (versions prior to the fix commit faba04ef4f2b410257f76c1b9dc85e350929c4b9)
Linux and Unix distributions that bundle GNU patch
Build and CI/CD environments that automatically apply third-party patches

Discovery Timeline

2026-07-09 - CVE-2026-56289 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-56289

Vulnerability Analysis

GNU patch parses unified-diff input by reading hunk headers of the form @@ -orig_start,orig_len +new_start,new_len @@. These headers instruct patch where to apply each block of changes in the target file. The vulnerable code path accepts arbitrarily large line offsets without validating them against the actual size of the file being patched.

When the specified line number is orders of magnitude larger than the file itself, the fuzz-matching and line-location logic iterates across a search space that will never yield a match. The loop lacks a bounded exit condition proportional to the target file, so the process spins on CPU-bound work until externally killed. Automated systems that apply untrusted patches, such as source distribution builders, package maintainer tooling, and continuous integration jobs, are the primary exposure surface.

Root Cause

The root cause is a missing sanity check on hunk line offsets during unified-diff parsing. GNU patch treats the attacker-supplied orig_start and new_start values as trusted bounds for its search loop. Because the loop terminates only when the requested position is found or the search heuristic exhausts a range derived from those attacker-controlled values, feeding extremely large numbers produces a loop with an effectively unreachable exit condition [CWE-835].

Attack Vector

Exploitation requires local delivery of a malicious patch file to a user or automated process that invokes patch. The attack requires user interaction (the target must run patch against the file) and does not require elevated privileges. Impact is limited to availability: the patch process becomes unresponsive and monopolizes a CPU core. There is no memory corruption, no data confidentiality impact, and no privilege escalation path. The upstream fix in commit faba04ef4f2b410257f76c1b9dc85e350929c4b9 adds validation of the hunk offsets before the search loop executes.

Detection Methods for CVE-2026-56289

Indicators of Compromise

Long-running patch processes consuming sustained 100% CPU on a single core with no I/O progress.
Unified-diff files containing hunk headers with implausibly large line numbers relative to the target file size (for example, @@ -999999999,1 +999999999,1 @@).
CI/CD job timeouts or hangs correlated with the ingestion of externally sourced patch files.

Detection Strategies

Scan incoming patch files for hunk headers where the line offset exceeds the line count of the target file before invoking patch.
Enforce wall-clock and CPU time limits on patch invocations using tools such as timeout or ulimit -t.
Log and alert on patch processes exceeding baseline runtime thresholds in build and packaging pipelines.

Monitoring Recommendations

Instrument CI runners to record process runtime and CPU utilization for patch executions and flag statistical outliers.
Track the source of patch files, distinguishing between trusted maintainer input and untrusted external contributions.
Review host telemetry for repeated SIGKILL or SIGTERM events targeting the patch binary, which suggest triggered hangs.

How to Mitigate CVE-2026-56289

Immediate Actions Required

Upgrade GNU patch to a build that includes commit faba04ef4f2b410257f76c1b9dc85e350929c4b9 or a distribution package that backports the fix.
Apply resource limits (timeout, ulimit) to all automated patch invocations that process untrusted input.
Audit CI/CD and packaging workflows that consume third-party diff files and restrict them to trusted sources where feasible.

Patch Information

The upstream fix is available in the GNU patch git repository at commit faba04ef4f2b410257f76c1b9dc85e350929c4b9. See the GNU Patch Commit faba04ef for the code change, the GNU Patch Repository for release information, and the CERT.PL advisory for coordinated disclosure details. Distribution maintainers should rebuild and republish patch packages with the fix applied.

Workarounds

Wrap patch invocations with timeout 60 patch ... to bound execution time when a fixed build is not yet available.
Pre-validate unified-diff input by rejecting hunk headers where the starting line number exceeds the target file's line count.
Restrict patch execution to isolated, resource-constrained environments (containers or sandboxes) when processing untrusted diffs.

bash

# Configuration example: bound patch runtime and CPU to contain the DoS
timeout --signal=KILL 30s patch -p1 < untrusted.diff

# Alternative using ulimit in a subshell (30 CPU seconds max)
( ulimit -t 30; patch -p1 < untrusted.diff )