# CVE-2026-56289: GNU patch infinite loop in unified-diff hunk processing

Source: https://junglewise.ai/threats/cve-2026-56289-gnu-patch-infinite-loop-in-unified-diff-hunk-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-56289 · Severity: info · CVSS 4.6 · Published 2026-07-09

GNU patch is a standard utility used to apply code changes to files. A vulnerability exists where a maliciously crafted patch file can cause the utility to enter an infinite loop, consuming all available processor power. This results in a denial of service, making the system unresponsive or preventing software updates from completing until the process is manually terminated.

Technologies: [Gnu Patch](https://junglewise.ai/threats/technologies/patch). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-56289 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56289 being exploited in the wild.

**How severe is CVE-2026-56289?** Informational severity, with a CVSS score of 4.6, published 9 July 2026.

**Which products and versions are affected?** Gnu Patch All through 2.8.0.

**Is there a fix for CVE-2026-56289?** A patch was published on 2026-04-21: Date of fix commit by Paul Eggert Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56289 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-56289?** Check whether you run Gnu Patch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

GNU patch (through version 2.8.0) contains a Loop with Unreachable Exit Condition (CWE-835) when processing unified-diff input. The vulnerability is rooted in improper validation of hunk line offsets; a specially crafted patch file can specify an extremely large line number, causing the application to enter an infinite loop while attempting to locate the requested position. This results in 100% CPU utilization and process hang. Exploitation requires a user to attempt to apply the malicious patch file locally. The issue has been addressed in commit faba04ef4f2b410257f76c1b9dc85e350929c4b9.

## Affected products

- GNU patch All through 2.8.0

## Timeline

- 2026-07-09: disclosed
- 2026-07-09: advisory
- 2026-04-21: patched: Date of fix commit by Paul Eggert

## References

- [https://cert.pl/en/posts/2026/07/CVE-2026-56288](https://cert.pl/en/posts/2026/07/CVE-2026-56288)
- [https://cgit.git.savannah.gnu.org/cgit/patch.git/](https://cgit.git.savannah.gnu.org/cgit/patch.git/)
- [https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9](https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9)

## Related threats

- [GNU patch arbitrary file creation via path traversal](https://junglewise.ai/threats/cve-2026-115207-a-flaw-was-found-in-gnu-patch-an-attacker-can-achieve-arbitrary)
- [GNU patch NULL pointer dereference in unified-diff processing](https://junglewise.ai/threats/cve-2026-56288-gnu-patch-null-pointer-dereference-in-unified-diff-processing)