CVE-2026-56289
Description
A flaw was found in GNU patch. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted patch file. The improper validation of hunk (single block of changes in diff) line offsets in unified-diff input can lead to an effectively infinite processing loop, resulting in excessive CPU consumption and making the utility unresponsive, requiring manual termination.
Statement
A moderate denial of service vulnerability was found in GNU patch, which ships in Red Hat Hardened Images. GNU patch does not properly validate hunk (single block of changes in diff) line offsets in unified-diff input: a specially crafted patch file that declares an extremely large line number causes the utility to enter an effectively infinite processing loop while attempting to locate the requested position, resulting in excessive CPU consumption and leaving the process unresponsive until it is manually terminated. Exploitation requires that a user or automated process apply the attacker-supplied malicious patch file; consequently Red Hat rates this flaw with a local attack vector and required user interaction (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), whereas the upstream record characterizes the attacker as remote. Both assessments rate the overall severity as moderate. The Red Hat Hardened Images product is affected, and a fix is being pursued through the delegated resolution process.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
