Dashboard / CVE-2026-56289

CVE-2026-56289

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 34/100
Published: 2026-07-09 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Active
S: X
AT: None
VC: None
VI: None
VA: Low

Description

GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination. This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
gnu patch < 2.8.0

References & Advisories (3)

Bug Bounty Relevance

34 / 100
✓ No authentication
✓ Low complexity

CVSS Score

4.6 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.11%
Raw Score 0.001150
Percentile 1.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00115
2026-10-28
0.00115

Intelligence Sources

nvd ref →

External Links